Google to Reduce SSL Certificate Lifespan to 90 Days

Recently, Google declared its plan to reduce the maximum validity for public TLS (SSL) certificates from 398 to 90 days.

Under its “Moving Forward, Together” plan, Google intended to limit the maximum public TLS certificate validity to 90 days via “future policy updates or a CA/B Forum Ballot Proposal,” a small but crucial point that should be noted.

The maximum duration of a public SSL certificate has been reduced from three years to two years to one year, and now Google has said that it plans to shorten this duration to 90 days further.

This 90-day maximum will probably be in place by the end of 2024, while the exact date is unknown.

The ecosystem will avoid complex, tedious, and error-prone issuing procedures by encouraging automation and adopting practices that reduce certificate lifetime. 

“Reducing certificate lifetime encourages automation and adopting practices that drive the ecosystem away from baroque, time-consuming, and error-prone issuance processes,” Google.

Google mentions that these changes will speed up the adoption of new security capabilities and best practices and promote the adaptability needed to switch the ecosystem to quantum-resistant algorithms quickly. 

Also, less reliance on “broken” revocation checking solutions that cannot fail-closed and hence provide insufficient protection will result from shorter certificate lifetimes. 

Moreover, the impact of unexpected Certificate Transparency Log disqualifications will be lessened with shorter-lived certificates.

In addition, Google intended to shorten domain validation reuse periods to 90 days.

 “More timely domain validation will better protect domain owners while reducing the potential for a CA to mistakenly rely on stale, outdated, or otherwise invalid information resulting in certificate mis-issuance and potential abuse,” Google.

Automation is Essential for Reducing Risk

It will be extremely challenging to manually manage the renewal and deployment of each server certificate more than four times each year, necessitating more than four times the effort that IT security personnel already have to do for an already challenging task.

Given that most businesses do not have a small number of certificates, this is a significant increase. It involves hundreds or thousands of certificates rather than a few dozen that must be handled four times annually.

Automation becomes even more important in this situation, especially as the duration of domain validation reuse and the lifespan of TLS/SSL certificates are decreasing.

Hence, IT managers should explore certificate automation options, such as CA agnostic Certificate Lifecycle Management (CLM) platforms. These solutions can aid in automatically provisioning and installing renewal and replacement certificates and detecting certificates in enterprise environments regardless of the Certificate Authority issuing them.

Ultimately, businesses need a way to scale up the automation of digital certificate lifecycles. Automation is essential for risk reduction.

Building Your Malware Defense Strategy – Download Free E-Book

Related Articles:

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for PrestaShop. The vulnerability, CVE-2024-36680, allows a…

1 day ago

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user information, including names and financial details,…

1 day ago

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart from typical Distributed Denial of Service…

1 day ago

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to execute arbitrary code on the server.…

1 day ago

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and valuable information, including API keys, logins,…

1 day ago

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs, folders, or websites. Created automatically during…

1 day ago