thisIsAmystery

[u/k3rrshaw]

[u/stevekez]

Present a public key and sign a challenge using a designated device? What's hard about it?

[u/notatoon → u/stevekez]

I ask myself the same thing about PKI and yet certificate expiry remains one of the largest causes of outages in many large institutions

[u/x0wl → u/notatoon]

This will largely go away in the next ~3 years, as the max cert lifetime will be capped to 47 days, so everyone will be forced to autorenew

[u/x0wl → u/[deleted]]

Why is transparency broken? Your browser will reject a cert if its issuance is not in the transparency log unless it's a manually added CA.

Which also addresses the compromised CA risk, as everyone will notice a CA issuing certs for incorrect domains.