Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)CR
Posts
20
Comments
506
Joined
1 yr. ago

  • You're right, Google released their vision in 2023, here is what it says regarding lifespan:

    a reduction of TLS server authentication subscriber certificate maximum validity from 398 days to 90 days. Reducing certificate lifetime encourages automation and the adoption of practices that will drive the ecosystem away from baroque, time-consuming, and error-prone issuance processes. These changes will allow for faster adoption of emerging security capabilities and best practices, and promote the agility required to transition the ecosystem to quantum-resistant algorithms quickly. Decreasing certificate lifetime will also reduce ecosystem reliance on “broken” revocation checking solutions that cannot fail-closed and, in turn, offer incomplete protection. Additionally, shorter-lived certificates will decrease the impact of unexpected Certificate Transparency Log disqualifications.

  • AFAIK, the only reason not to use Letsencrypt are when you are not able to automate the process to change the certificate.

    As the paid certificates are valid for 12 month, you have to change them less often than a letsencrypt certificate.

    At work, we pay something like 30-50€ for a certificate for a year. As changing certificates costs, it is more economical to buy a certificate.

    But generally, it is best to use letsencrypt when you can automate the process (e.g. with nginx).

    As for the question of trust: The process of issuing certificates is done in a way that the certificate authority never has access to your private key. You don't trust the CA with anything (except your payment data maybe).

  • At least for me, this works out of the box.

    Some requirements:

    • All the devices need to be on the same network
    • DNS needs to work or you have to use IP adresses for connecting. I've configured local DNS on my router.
  • This community has only two posts and a few comments. The algorithm has very few information on such tiny communities.

    It would probably be useful to only include communities with a minimum amount of interaction to avoid such outliers.