{"id":28215,"date":"2020-02-24T16:10:36","date_gmt":"2020-02-24T21:10:36","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=28215"},"modified":"2021-09-24T16:20:57","modified_gmt":"2021-09-24T20:20:57","slug":"safari-to-reject-https-certificates-longer-than-a-year","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2020\/02\/24\/safari-to-reject-https-certificates-longer-than-a-year\/","title":{"rendered":"Safari to Reject HTTPS Certificates Longer Than a Year"},"content":{"rendered":"

Ivan Mehta<\/a>:<\/p>\n

Last week, at the 49th CA\/Browser Forum, a voluntary consortium of certification authorities, Apple announced that it’ll stop allowing HTTPS certificates on Safari with more than 13 months of validity, later this year.<\/p>

[…]<\/p>

As the Register<\/a> noted, sites like GitHub and Microsoft have certificates with two-year validity. Under Apple’s new rule, these sites will be rejected if these companies will get another two-year certificate after August.<\/p><\/blockquote>\n\n

Jason Snell<\/a>:<\/p>\n

The rationale? Shorter certificate lifetimes are safer, for a variety of reasons<\/a>. For one thing, it prevents a valid (and perhaps abandoned) certificate from being stolen or misappropriated by a bad actor, then used to trick consumers. While there is a process for revoking known bad certificates, it’s cumbersome and many browsers don’t even check the revocation lists.<\/p>

For another, quick turnaround helps ensure that the certificates are always secured using the latest cryptographic standards.<\/p>

[…]<\/p>

The major downside for certificates that expire more often is that it means more work for organizations that have a large number of certificates that they will now need to renew more often.<\/p>

[…]<\/p>

At least one previous proposal to reduce the life of accepted certificates has been put to the CA\/Browser Forum, but while it was widely supported by browser makers, it didn’t garner enough support from Certificate Authorities to make any head way. So Apple, in its own tried and true fashion, has apparently decided to make a unilateral change for what it believes is the best for users.<\/p><\/blockquote>\n

Previously:<\/p>\n