Why Do SSL/TLS Certificate Lifetimes Keep Getting Shorter?: Everything You Need to Know for the 47-Day Era

The primary reason behind the transition to shorter-lived certificates in the SSL/TLS industry is due to the inherent weaknesses and limitations of current revocation mechanisms, particularly OCSP (Online Certificate Status Protocol). Here are the key points that explain this shift:

1. Revocation Mechanisms Are Broken: Traditional methods like CRLs (Certificate Revocation Lists) and OCSP suffer from scalability issues, privacy concerns, and reliability problems. For instance:

   • CRLs can become too large to distribute efficiently.
   • OCSP checks are prone to network latency and failures, making real-time revocation impractical.

2. Browser Vendors' Response: Major browsers have moved away from relying on OCSP for certificate validation due to these issues:

   • Chrome: Discontinued real-time OCSP checks in 2012.
   • Firefox: Implemented CRLite, a compressed revocation database using Bloom filters.
   • Safari: Uses an Apple proprietary OCSP proxy but still faces privacy concerns.

3. Shorter Certificates as a Solution: Given the unreliability of revocation mechanisms:

   • Shortening certificate lifetimes ensures that even if a private key is compromised, the

Read the full article at DEV Community

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.