Hacker News new | ask | show | jobs
by lasdfas 3046 days ago
How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
3 comments
jD91mZM2 3045 days ago
Since only the keypair is cached, certificates are generated on each startup. This means they never expire (unless you run your application without any interruptions for a whole year).

But yeah, if they're leaked you just gotta re-send them to the clients. This isn't meant for large professional projects, only for stuff where the convenience outweights the pros of using a proper certificate.

link
nemothekid 3046 days ago
You would probably need some sort of "authority" to redistribute the hashes.
link
jsiepkes 3045 days ago
The was / is a DNS standard for that: DANE. Sadly DANE was never really adopted. Chrome had support for it but it was removed eventually.
link
lasdfas 3045 days ago
One of the main reasons for the library is no need for cert authority. Why not just create a regular cert Authority certificate and put the trusted authority cert on the clients. That makes it so you almost never have to change the clients certs. Also, it's supported by standard TLS libraries and clients.
link
jD91mZM2 3045 days ago
True, didn't think of that. The server would still have to generate it using a command though... I like having things automated.
link
hamandcheese 3046 days ago
Pretty much same story as SSH keys and fingerprints.
link