Podcast
Root Causes 459: 2024 Lookback - Shortening Certificate Lifespans & DCV


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
January 24, 2025
2024 set in motion major changes for certificate lifespans and DCV. In this episode we discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics.
Podcast Transcript
Lightly edited for flow and brevity.
If you heard about Google's 90-day, which is what Tim just was just talking about, and then you hear about Apple's proposal of 200 and all the way down to 45 you think, what's with all these numbers? It's all around that the value of 90-day anyway. It’s just slicing and dicing based off of that. So if you think about it, like Tim will tell you, a one year certificate, it's not one year. It's 398 days, because there's some forgiveness for pragmatic reasons to make sure that you get the full value of one year, plus an ability to renew and deal with problems and it's a very pragmatic way that the industry works. So when Google said 90 days, they were just saying something that was already a lot of CAs already issued 90-day certificates. The problem with a 90-day certificate, Tim, is that you don't get the full value of a 90-day. Therefore Apple saying 100 days. You get 10 extra days of grace.
Number one is, again, very pragmatic and considered. Why was the first stepdown 200 days because that's a six months cadence, plus some some wiggle room.
The second thing we noticed about Apple proposals, which is what you're getting to, Jason, which I think is incredibly important, is the step down. That's the major initiative here is to say we're not going to leap directly from 398 days to quarterly. We will have a step down process that will get us to where we need to be over the course of several years and what that does is that makes the whole thing much more implementation friendly.
Now the last objection is stuff that legitimately you can't automate, most of which is either homegrown or unsupported platforms technology. And the response to that is, if you're using platforms and technology that are not automatable, then ultimately you have a business continuity, a robustness and a security problem that badly needs addressing, and it needs addressing anyway, let's kill two birds with one stone.

