{"id":38175,"date":"2019-10-31T22:22:05","date_gmt":"2019-10-31T19:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej\/"},"modified":"2019-10-31T22:22:05","modified_gmt":"2019-10-31T19:22:05","slug":"forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","title":{"rendered":"The CA\/B Forum voted against reducing the validity period of SSL certificates to 397 days.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On July 26, 2019, Google made a proposal<\/a><\/noindex> to reduce the maximum lifespan of SSL\/TLS server certificates from the current 825 days to 397 days (about 13 months), roughly halving it. Google believes that only full automation of certificate management can eliminate the current security issues often attributed to human error. Therefore, ideally, there should be a move towards the automated issuance of short-lived certificates.<\/p>\n

The issue was put to a vote in the CA\/Browser Forum (CABF), which sets the requirements for SSL\/TLS certificates, including the maximum lifespan.<\/p>\n

And on September 10 the results were announced<\/a><\/noindex>: consortium members voted against<\/b> on the proposal.
\n<\/a><\/noindex><\/p>\n

Results<\/h1>\n

<\/p>\n

Voting by certificate publishers<\/h4>\n

In favor (11 votes)<\/b>: Amazon, Buypass, Certigna (DHIMYOTIS), certSIGN, Sectigo (formerly Comodo CA), eMudhra, Kamu SM, Let’s Encrypt, Logius, PKIoverheid, SHECA, SSL.com<\/p>\n

Against (20)<\/b>: Camerfirma, Certum (Asseco), CFCA, Chunghwa Telecom, Comsign, D-TRUST, DarkMatter, Entrust Datacard, Firmaprofesional, GDCA, GlobalSign, GoDaddy, Izenpe, Network Solutions, OATI, SECOM, SwissSign, TWCA, TrustCor, SecureTrust (formerly Trustwave)<\/p>\n

Abstained (2)<\/b>: HARICA, TurkTrust<\/p><\/blockquote>\n

<\/p>\n

Voting by certificate consumers<\/h4>\n

In favor (7)<\/b>: Apple, Cisco, Google, Microsoft, Mozilla, Opera, 360<\/p>\n

Against<\/b>: 0<\/p>\n

Abstained<\/b>: 0<\/p><\/blockquote>\n

\nAccording to the rules of the CA\/Browser Forum, for a positive decision, two-thirds of the certificate issuers and 50% plus one vote among consumers must be in favor.<\/p>\n

Representatives of Digicert apologized<\/a><\/noindex> for missing the vote, where they would have cast their ballot in favor of reducing the lifespan of certificates. They note that for some clients, the reduction in lifespan could pose a problem, but in the long term, it offers security benefits.<\/p>\n

Nevertheless, the industry is still not ready to shorten the lifespan of certificates and fully transition to automated solutions. Certification authorities can offer such services, but many clients have yet to implement automation. Therefore, the reduction to 397 days is currently postponed. However, the question remains open.<\/p>\n

Now Google might attempt to enforce the standard 'mandatorily', as was done with the protocol Certificate Transparency<\/a><\/noindex>. Moreover, it is supported by other developers: Apple, Microsoft, Mozilla, and Opera.<\/p>\n

Let us remind you that full automation is one of the principles on which the non-profit certification center Let's Encrypt operates. It issues free certificates to anyone who wishes to obtain one, but the maximum lifespan of a certificate is limited to 90 days. Short certificate lifetimes have two main advantages<\/a><\/noindex>:<\/p>\n

    \n
  1. limiting damage from compromised keys and incorrectly issued certificates, as they are used over a shorter time frame;\n<\/li>\n
  2. Short-lived certificates support and encourage automation, which is crucial for the ease of use of HTTPS. If we are going to migrate the entire World Wide Web to HTTPS, we cannot expect the manual updating of certificates by the administrator of every existing site. Once the issuance and renewal of certificates become fully automated, shorter lifetimes for certificates will actually become more convenient and practical. <\/li>\n<\/ol>\n

    \nGlobalSign survey on Habr<\/a><\/noindex> showed that 73.7% of respondents are \"somewhat in favor of\" reducing certificate validity periods.<\/p>\n

    Regarding the hiding of the EV badge for SSL certificates in the address bar, the consortium did not vote on this issue because the browser UI matter is entirely within the purview of developers. New versions of Chrome 77 and Firefox 70, which will remove the special status of EV certificates in the browser address bar, are set to be released in September-October. Here\u2019s how the change looks in the desktop version of Firefox 70:<\/p>\n

    Previously:<\/p>\n

    \"The
    \n
    \nIt will be:<\/p>\n

    \"The
    \n
    \nAccording to security expert Troy Hunt, the removal of EV information from browser address bars     essentially buries this type of certificate.<\/a><\/noindex>.
    \n
    Source:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 SSL\/TLS \u0441 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 825 \u0434\u043d\u0435\u0439 \u0434\u043e 397 \u0434\u043d\u0435\u0439 (\u043e\u043a\u043e\u043b\u043e 13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432\u0434\u0432\u043e\u0435. Google \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043b\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u0441\u043a\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u0438\u0434\u0435\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28658,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The CA\/B Forum voted against reducing the validity period of SSL certificates to 397 days | ProHoster","description":"On July 26, 2019, Google proposed reducing the maximum validity period of server certificates.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u043e\u0440\u0443\u043c CA\/B \u043f\u0440\u043e\u0433\u043e\u043b\u043e\u0441\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0442\u0438\u0432 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043e 397 \u0434\u043d\u0435\u0439 | ProHoster","og:description":"26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:05+00:00","article:modified_time":"2019-10-31T19:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38175","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:47:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:29:57","updated":"2026-01-23 20:47:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=38175"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/28658"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=38175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=38175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=38175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}