Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The old Let's encrypt root certificate (DST Root CA X3 [1]) was from 2001, was signed with sha1, and is 2048 bit RSA.

What criteria would you use to decide expiration dates for 20 years in the future?

[1]: https://crt.sh/?id=8395



To be clear, the self-signature on a root certificate is meaningless (it only exists so that root certificates can be parsed with the same code as intermediate and leaf certificates); using SHA-1 there is not a risk.

https://www.entrust.com/blog/2014/04/need-sha-2-signed-root-...


Let's Encrypt was only founded in 2014, and left beta in April 2016; they just used that cert to start with IIRC. So it's been about 5 years for LE users, not 20.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: