{"id":796,"date":"2020-06-29T08:47:56","date_gmt":"2020-06-29T06:47:56","guid":{"rendered":"https:\/\/bretterhofer.at\/blog\/?p=796"},"modified":"2020-06-29T17:59:54","modified_gmt":"2020-06-29T15:59:54","slug":"apple-strong-arms-entire-ca-industry-into-one-year-certificate-lifespans","status":"publish","type":"post","link":"https:\/\/bretterhofer.at\/blog\/2020\/06\/apple-strong-arms-entire-ca-industry-into-one-year-certificate-lifespans\/","title":{"rendered":"Apple strong-arms entire CA industry into one-year certificate lifespans"},"content":{"rendered":"
\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
Apple, Google, and Mozilla reduce the lifespan for HTTPS certificates to 398 days, against the wishes of Certificate Authorities.<\/span><\/div>\n<\/div>\n
\n
Following <\/span>Apple’s initial announcement<\/span><\/span>, <\/span>Mozilla<\/span><\/span> and <\/span>Google<\/span><\/span> have stated similar intentions to implement the same rule in their browsers.<\/span><\/div>\n<\/div>\n
\n
Starting with September 1, 2020, browsers and devices from<\/span> Apple, Google, and Mozilla will show errors for new TLS certificates that have a lifespan greater than 398 days<\/span><\/div>\n<\/div>\n
\n
https:\/\/github.com\/mozilla\/pkipolicy\/issues\/204<\/span><\/span><\/a><\/div>\n<\/div>\n
\n
https:\/\/chromium.googlesource.com\/chromium\/src\/+\/ae4d6809912f8171b23f6aa43c6a4e8e627de784<\/span><\/span><\/a><\/div>\n<\/div>\n
\n
https:\/\/support.apple.com\/en-us\/HT211025<\/span><\/span><\/a><\/div>\n<\/div>\n
\n
https:\/\/www.zdnet.com\/article\/apple-strong-arms-entire-ca-industry-into-one-year-certificate-lifespans\/<\/span><\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
For IT Departments this means we need to invest into automation of the whole certificates process (CSR, install, renew, DH). No email work flows, no manual processes. <\/span><\/div>\n
Usage of ACME<\/a> with pre and post installation hooks, dns validation will become now finally mandatory<\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
About upcoming limits on trusted certificates<\/span><\/div>\n<\/div>\n
\n
In our ongoing efforts to improve web security for our users, Apple is reducing the maximum allowed lifetimes of TLS server certificates.<\/span><\/div>\n<\/div>\n
\n
What’s changing<\/span><\/div>\n<\/div>\n
\n
TLS server certificates issued on or after September 1, 2020 00:00 GMT\/UTC must not have a validity period greater than 398 days.<\/span><\/div>\n<\/div>\n
\n
This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. Additionally, this change will affect only TLS server certificates issued on or after September 1, 2020; any certificates issued prior to that date will not be affected by this change.<\/span><\/div>\n<\/div>\n
\n
Connections to TLS servers violating these new requirements will fail. This might cause network and app failures and prevent websites from loading.<\/span><\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\u00a0 Apple, Google, and Mozilla reduce the lifespan for HTTPS certificates to 398 days, against the wishes of Certificate Authorities. Following Apple’s initial announcement, Mozilla<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[34,35,30,18],"tags":[],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/posts\/796"}],"collection":[{"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/comments?post=796"}],"version-history":[{"count":1,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/posts\/796\/revisions"}],"predecessor-version":[{"id":797,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/posts\/796\/revisions\/797"}],"wp:attachment":[{"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/media?parent=796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/categories?post=796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bretterhofer.at\/blog\/wp-json\/wp\/v2\/tags?post=796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}