[cabfpub] Short-Lived Certs - the return

Ryan Sleevi sleevi at google.com
Sat Jun 6 00:06:51 UTC 2015


On Fri, Jun 5, 2015 at 1:06 PM, Doug Beattie <doug.beattie at globalsign.com>
wrote:

>  This topic has been on the back burner for a while and I think we should
> move it to pre-pre-ballot discussions.
>
>
>
> Given both OCSP and CRL max validity are set at 10 days, I’d recommend we
> allow SSL certificates to omit OCSP and/or CRL information if they are 10
> days or less in duration, that is currently the max lag time a relying
> party can go without an update (most CAs actual controls are much shorter
> than this, and they can also have shorter limits on their “short validity
> SSL certificates”)
>
>
>
> I also recommend that we clearly specify that you cannot pre-date a
> certificate by more than 24 hours, and you cannot postdate the certificate
> at all as part of this ballot (to make it clear you cannot pre-generate a
> years’ worth of certs ahead of time).
>
>
>
> I would propose that we allow DV/OV and EV certificates to implement this;
> however, if EV should be exempt of have a shorter limit, I’m fine with that.
>
>
>
> In summary:
>
> 1.      DV/OV/EV certificates with validity periods of 10 days (240
> hours) or less may omit CDP and OCSP URLs
>
> 2.      Certificates may be dated in the past by up to 24 hours
>
> 3.      Certificates must not be dated in the future
>
>
>
> Conceptually, is this something the members feel they can support?  If so,
> I can start on a pre-ballot and we can discuss at the F2F.
>
>
>
It looks like Microsoft has set their OCSP validity requirements at 7 days,
with a required next-update of 1/2 the validity period (
https://technet.microsoft.com/en-us/library/cc751157.aspx )

While the BRs' max validity is at 10 days, with Microsoft's move to shorten
it (conceptually, to 7, but for purposes of equivalency, this would be
3.5), would it be more suitable to just adapt those dates for a discussion
of short-lived certs?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20150605/53db1e75/attachment-0003.html>


More information about the Public mailing list