Hacker News Reader

Comment by hannob | Hacker News Reader

That is... a very absurd idea.

You really don't want a situation where webpages may work or not work based on some completely unclear criteria.

This is exactly what Safari deciding to arbitrarily not trust valid certs is.

The de facto standard will be that you will need to accommodate the least tolerant user agent if you want your certs to work for all browsers.

But Safari has laid out clear criteria as to under what conditions the certs will be invalid.

If I'm understanding correctly, the GP is saying browsers should be making decisions based on a much wider variety of criteria (for example, who issued the cert, how popular is the website using the cert, etc), which would be much more difficult to troubleshoot.

The likely result is that two year certs will just cease to be available, even if other clients don't decide to make an equivalent rule.

And yes, the de facto standard is that for the general purpose web you can't sell certificates based just on, for example, getting an OK from Microsoft (whose trust stores includes a tonne of governments and government agencies whose inclusion a cynic might assume is not coincidental to those governments agreeing to purchase Microsoft's products...) because those certificates don't work on an iPhone or in Firefox or...

The relationship that is symbolised by the CA/Browser Forum has always been asymmetrical like this, it was this way before the CA/B Forum was created, and if the two groups aren't able to reach common ground the CA/B will just gradually go away.

It's basically what has been announced here, though, no? There's no technical impediment to a CA continuing to hand out 2+ year certs. The only reason they would not do so is that webpages will start breaking if they're accessed from Safari.

The criteria are very clear:

- Safari

- max 398 days

> The criteria are very clear:

today. Tomorrow they may change to be 397 days, or 39.8 days, or "until the next iPhone is released".

Isn‘t that a bit like arguing about the 825 days? The CA/B could change that aby day they want and there‘s nothing you can do. Others will follow Apple and the CA/B will follow too, like they should have in 2017, IMHO.

The 398 days isn‘t something they came up right before they presented it. It‘s already 3 years old...

Nope. Today, tomorrow and for 6 more months is 825 days. As of September 1, 2020, it will be 398 days - a change people knew was coming for a long time.

The point is that they can change it any time ("tomorrow"), not that they will literally change it tomorrow. How much time they will give you to prepare doesn't really matter, it's still unilaterally forcing everyone to adapt.

To the owner of the cert, I suppose. But how many browser users are even aware of the existence of certificates, let alone CAs and expiration dates?

Yes but what we have now is also absurd. One day I can visit a site just fine and the very next I can’t and the browser won’t even let me override the “invalid” certificate.

How about grading the validity of the certificate on a continuous scale? P(site loads) = 1 - R*(days since issue) where browsers can choose R as they wish. This gets rid of this discontinuity.

Reply on news.ycombinator.com