That would open a new vector of attack where an attacker would simply have to compromise any of your previous certs; not necessarily an easy feat but still a new vector
No, the world we have is one where these expiry mishaps happen all the time, and everyone would be better served if certs had a warning expiration date in addition to the red alert one. It's the old "don't delete a customer the second they are late on a single payment" thing that everyone long recognizes as good practice.
I think whole thing could be solved by having soft and hard expiry dates. It is an extensible format after all.
It's just a small grace window to let users still be able to use the site. Just like an expiration date on your milk. There's no need to toss it out immediately just because an extra nanosecond passed.
Hsts does not even give users a choice because nobody could come up with a scary enough warning.
People already understand expiration dates aren't exact. They deal with it in all kinds of places. It's not a new concept.
> People already understand expiration dates aren't exact. They deal with it in all kinds of places. It's not a new concept.
Try crossing the border with an expired passport and see how non-exact expiry dates are.
I'm saying load the website by default; just display a warning that isn't too intrusive or alarming. As a starting point (not suggesting this is peak UX; it's just a starting point for the discussion): it could be just a small balloon notification on the padlock with black text, nothing in red or otherwise alarming (or maybe becoming more red as more time has passed). A little bit like the balloon Chrome displays for "Disable developer-mode extensions". It still lets you use the browser but also gets its point across.
> Try crossing the border with an expired passport and see how non-exact expiry dates are.
You couldn't think of expiration dates for things that aren't at the extreme? Maybe for actions whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border?
> You couldn't think of expiration dates for things that aren't at the extreme? Maybe for things whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border?
Passports are a credential, so are certificates. Generally expiry dates are strictly enforced on credentials. Same thing applies to driver licenses, health cards, etc.
Also, people absolutely do accept expired credentials for some things. Not for others. It depends on the seriousness of the situation and the consequences (especially legal consequences) for failing to validate the IDs properly.
You simply can't just pretend visiting a website is anything remotely comparable to crossing a border or producing an ID for law enforcement no matter how much you insist on it, so I'm not going to entertain this anymore.
I use TLS to communicate about taxes.
Those are hardly trivial things.
If you don't like id documents as a comparison despite certificates literally being identity documents, you could compare it to business licenses instead.
The reason that food has imprecise expiry dates is because we don't know when food will actually go bad. We do know how it is distributed, so we make a guess and err a couple standard deviations on the side of caution. However, we know precisely when a certificate will expire. The standard deviation for a certificate expiring (ignoring clockskew) is 0. If we gave 5 standard deviations of warning time on a certificate, it would still be 0 warning.
The problem with the current narrative is that we're coerced into using TLS for everything, including trivial things. If you don't, you - as the owner of the website - are punished in different ways, even if the consequences for the visitor are none. As a consequence the web is full of expiration alerts that only make people more confused.