361
submitted 6 months ago by misk@sopuli.xyz to c/technology@lemmy.world
you are viewing a single comment's thread
view the rest of the comments
[-] hsdkfr734r@feddit.nl 90 points 6 months ago

When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn't the biggest issue with server certificates.

[-] jagged_circle@feddit.nl 0 points 6 months ago

Yes X.509 is broken. If you're a developer and not pinning certs, you're doing it wrong.

[-] oldfart@lemm.ee 3 points 6 months ago

Yeah, now imagine pinning certs that change weekly.

My first thought is that old school secure software (like claws-mail) treats a cert change as a minor security incident, asking you to confirm every time. Completely different school of thought.

[-] jagged_circle@feddit.nl 1 points 6 months ago* (last edited 6 months ago)

You can pin to your own CA. Then it doesn't matter if you want to update your certs frequently.

[-] oldfart@lemm.ee 1 points 6 months ago
load more comments (10 replies)
load more comments (12 replies)
this post was submitted on 16 Dec 2024
361 points (97.9% liked)

Technology

72585 readers
1125 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS