The Race Towards 47-day Certificate Lifetimes : A large Scale Measurement Study of Practices, Trends and Risks

Sammanfattning

Digital certificates are the basis for secure communication in the modern internet landscape. A key part to ensure correct certificate management is to choose a lifetime of thecertificate. The lifetimes of TLS certificates has long been debated and the landscape is currently changing rapidly. This paper presents a large-scale analysis of TLS certificate lifetimes among the most popular websites. Through analyzing certificates collected from onemillion domains, we have observed how the practices of deciding lifetimes differ acrossthe web and how factors such as issuing CA and popularity of the website may have aneffect on the set lifetime. The results suggest that the transition towards short-lived certificates will be a challenge for the actors within the PKI. as the bar continues to go lower. Thestudy was conducted during the shift from 398 days down to 200 days, although the officiallimit will reach 47 days in the forthcoming years. As this shift happens, proper certificatemanagement and automatic renewals are essential to maintain trust and stability withinthe constantly evolving PKI landscape.