Pros and cons of 90-day certificate lifetimes

Note that if you were vulnerable to Heartbleed, you could have had your private key stolen and not know it happened. With a long-lived certificate where you didn't revoke it manually, that's a lot of time for a potential attacker to have access to private data.

Where I work (medical startup) we had a client that ignored our warnings that their provided certificate was near expiration until it actually expired after hours in the middle of a week. Suddenly, it was an emergency as they had a customer needing to use the service the next day. We've moved the subdomain they use over to Let's Encrypt and won't have to worry about that kind of mess with them anymore.

Suffice to say, it isn't always the admin that "forgets" to renew. Also, sometimes circumstances delay action and that can create an issue where the certificate doesn't get renewed in time. Automating renewals resolves the problem of needing human intervention as a matter of course.

Obviously this isn't directly related to certificate lifetime. You can automate for one or three year expirations, but the process is more likely to fail since it's run so rarely. Besides that, if you can automate why not also gain the security benefits of short lifetimes?

That's my understanding as well. The OCSP servers have to respond that the certificate is revoked until past the expiration date. This means that signing still has to take place.

1 Like