Seeing the discussion about the challenges of rotating certificate private keys in the Certbot support for ECDSA certificates thread brought to mind a question I've been meaning to ask: What's the best practice for rotating account keys? I don't see a lot of guidance around it, and I don't think m…

Compromise of the private key of an account key pair has more serious consequences than compromise of a private key corresponding to a certificate. I completely disagree with that first sentence. I, for one, would much prefer that someone be able to revoke my certificates (thus temporarily shutt…

Well, it's good to know that it's not just me that found that sentence suspect. The RFC goes on to list 4 specific problems with an account key compromise: Issuing certificates using existing authorizations Sure, that's a problem, and lets you compromise all domains validated recently instead o…

You pose excellent questions. Typically the contact email is only used for notification of issues or expiration notices. I could see how denying access to that information (via changing the contact) could pose some risks. Locking out the legitimate account holder could be annoying, but it takes seco…

[image] griffin: why would website ACME clients, like mine , be allowed to operate at all? Very good question indeed. [image] griffin: Handling a compromised account key: Warn people of potential downtime. Fix the leak. Create a new ACME account. Reissue all involved certificates. Warn…

[image] Osiris: Don't forget step 0.: unregister the account in question! I would assume that the first thing a knowledgeable attacker would do upon compromising an account key would be rotating it to a new one that they solely control. If you still have the account key, rather than deactivat…

The account key rotation I'm referring to is the "Key Change" command, section 7.3.5 of the RFC . Works fine on Let's Encrypt when I was playing around with it. I just don't know if there's some recommendation on how often one should do it, or if it's just "safer" in some sense to never rotate unless…

[image] petercooperjr: I would assume that the first thing a knowledgeable attacker would do upon compromising an account key would be rotating it to a new one that they solely control. If you still have the account key, rather than deactivating the account you could just rotate the key to a new…

As best I could tell when I was experimenting with this, once an account key is rotated the old key isn't anywhere in the system (at least for Let's Encrypt). I think you could even make a certificate using that old key, since it's not on the can't-make-certificate-keys-matching-account-keys list an…

This is starting to sound like this short topic: [image] Compromised Key Questions Client dev G… So it seems marking an AccountKey as compromised must still be done by alerting the LetsEncrypt service, though a rollover or deactivation would have the same effect of bla…

And this topic (that you sent me for grammar lessons @rg305 :slightly_smiling_face:): [image] Certbot support for ECDSA certificates Issuance Tech K…

Account Key rotation best practice?

Issuance Tech

griffin October 2, 2020, 12:28am 12

And this topic (that you sent me for grammar lessons @rg305 ):

Topic		Replies	Views
Question re: Change in Revocations Methods Issuance Policy	50	3956	December 16, 2021
Create a secondary key for my account Help	9	345	August 23, 2024
How to check, if a private key is a valid Let's Encrypt account key? Help	28	7243	September 8, 2021
Will Account rotation invalid the orders create by the old key? Issuance Tech	8	180	November 4, 2024
What to do if the account key is compromised? Issuance Tech	7	2639	September 1, 2017

Account Key rotation best practice?

Related topics