The initiative to shorten SSL/TLS certificate lifespans has been ongoing, and Google’s recent proposal to reduce SSL/TLS certificate validity to 90 days marks a significant potential shift. Many organisations are now questioning how this proposal will affect them and the broader industry. In this blog, we'll explore the implications and explain why automating SSL/TLS certificate management has become essential.
How is ACME Shaping the Future of SSL/TLS Certificate Validity?
The Automated Certificate Management Environment (ACME) protocol was created to streamline certificate lifecycle management. Developed by the Internet Security Research Group (ISRG), ACME was designed to address the need for frequent certificate renewals. Unlike other commercial Certificate Authorities (CAs) adhering to the CA/Browser Forum’s guidelines, ACME simplifies the renewal process, making it easier to manage certificates that need to be replaced every 90 days.
What is the Current Maximum Validity Period of an SSL/TLS Certificate?
Presently, SSL/TLS certificates have a maximum validity period of 397 days, as per the CA/Browser Forum’s Baseline Requirements. However, Google's recent proposal to shorten this period to 90 days indicates a push towards more frequent renewals, aimed at enhancing security and reliability.
When is Google Implementing the 90-Day Certificate Validity?
As of now, Google’s proposal has not been officially enacted. They have initiated a survey among CAs to gather feedback on this potential change. Following this consultation, an enforcement date may be announced. We will keep you informed as the situation evolves.
Why is Shorter Certificate Validity Beneficial?
In the past, SSL certificates could be purchased for up to five years. However, this duration has been progressively reduced. The reasoning is clear: the longer a certificate is valid, the less reliable it becomes. SSL/TLS certificates verify the identity of web servers, and over time, changes such as mergers, domain sales, and business closures can occur. Regular verification ensures that authentication remains current and dependable.
Automation: A Necessity
Managing SSL/TLS certificates manually is labor-intensive. Tasks include planning, handling validations, issuing certificates, installing them on servers, and ensuring timely renewals. This process is challenging enough on an annual basis, but with a 90-day validity, it becomes even more demanding. Here’s where ACME is invaluable.
Advantages of Using AretiicoConnect
AretiicoConnect streamlines SSL/TLS certificate management through automation. It handles certificate requests, domain validation, installation, and renewal, eliminating the need for manual intervention. By automating these processes, AretiicoConnect ensures that certificates remain current and significantly reduces the risk of missed renewals.
Highest Standards in Security for Certificate Lifecycle Management
AretiicoConnect adheres to the most rigorous security practices throughout the entire lifecycle of a certificate. From issuance and renewal to updates and revocation, every step is managed with WebTrust-backed security measures to protect against vulnerabilities and ensure the integrity and reliability of the certificates.
- Visibility: Centralised monitoring of all public and private TLS/SSL certificates, regardless of the issuing CA.
- Flexibility: Prevent certificate expirations with tailored automation methods and integration options like ACME, REST API, and GraphQL.
- Consistency: Ensure security compliance by verifying certificates meet key length, hashing algorithms, and validation standards, while reducing deployment errors with Discovery and Automation.
- Efficiency: Reduce IT resource expenditure on SSL certificate and network access management.
- Scalability: Manage and automate workflows for unlimited certificates and user identities from one platform, with comprehensive control over all certificate types and network devices.
Preparing for the Potential Change
Organizations should start preparing for the possibility of a 90-day certificate validity by:
- Achieving Complete Visibility: Maintain a centralised inventory of all certificates with details like expiration dates, locations, issuing CAs, and owners.
- Monitoring Certificates: Set up automated alerts for expiring certificates to ensure timely renewals.
- Automating Lifecycle Processes: Utilise solutions like AretiicoConnect to automate the renewal and provisioning process.
- Defining Clear Ownership: Establish roles and responsibilities for certificate management to avoid confusion and ensure accountability.
- Implementing PKI Policies: Enforce strict PKI policies to standardise certificate issuance and management.
Conclusion
With Google's proposal to reduce SSL/TLS certificate validity periods, automation is now a necessity rather than an option. AretiicoConnect offers a robust solution to manage this potential transition smoothly, ensuring continuous security and operational efficiency. By adopting automated certificate management, organisations can stay ahead of the curve and maintain the highest levels of security and reliability.
Stay tuned for more updates and begin preparing your organisation for the future of SSL/TLS certificate management with AretiicoConnect.
