Hacker News new | ask | show | jobs
by snowstormsun 1082 days ago
Certificates also need to be rotated at some time.
2 comments
BlackFly 1082 days ago
Yes, just like passwords need to be rotated at some point. Of course in 2023 people have already reconsidered what the practical effect on security of that policy was as opposed to the theoretical effect. Perhaps client certificate rotation would be as unnecessary as password rotation for similar reasons or perhaps automation like for server certificates could be used for similar reason.
link
akira2501 1082 days ago
the acme protocol handles this. is there space for an 'email-01' or similar mechanism for client certificate verification?
link
growse 1082 days ago
Why are we desparate to jam X509 into every hole, regardless of whether or not it's a good idea?

mTLS for most cases is not a good idea. For the masses, it's certainly not a good idea.

link