The 47-day certificate: faster treadmill, same broken foundation

Managing TLS certificates has become pretty crazy: Over the years validity was cut down from several years to two years to one year to half a year now. In a few years it will be only a little more than one month, with the additional requirement to basically continuously prove domain control.

Since I'm not using Let's Encrypt over here, these days I have to re-submit a CSR to my certificate provider every half a year for every domain, prove domain ownership, install the new certificate (chain), and update my DANE/TLSA records. Soon continuous domain control validation will have to be added as an additional secondary process to the domain reactivation/renewal process.

Certificate providers willing to help their customers automate these "industry-mandated" processes suggest setting DNS records referring to their systems for everything dynamic, or handing over DNS management to them completely.

Forcing users to automate their certificate management is one thing — it admittedly will make WebPKI safer — still we should never have allowed Big Internet — in this case Apple, Google, Microsoft, and the other browser builders — to take control of the public internet certificate infrastructure. After making self-signed certificates practically useless, everyone has now been brought under their regime and has been forced onto their highly centralized Certificate Transparency (CT) infrastructure.

The CT infrastructure, however, is a patch rather than a structural solution for the issues with rogue certificates, a problem made far worse by the highly centralized WebPKI that fails to compartmentalize different chains of trust.

Even though the use of self-signed certificates pinned with a DANE/TLSA record probably is a closed chapter now — browser builders declined to support it due to lagging DNSSEC adoption — I still think it's a better (additional) solution, especially for non-enterprise users wanting to manage their own domains and hosts. Furthermore, it keeps control over domains, certificates and pins where it naturally belongs: locally in the distributed DNS hierarchy.