Load on the underlying infrastructure is a concern. The signing keys are all in ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		fs111 on April 16, 2025 \| parent \| context \| favorite \| on: TLS certificate lifetimes will officially reduce t... Load on the underlying infrastructure is a concern. The signing keys are all in HSMs and don't scale infinitely.

bob1029 on April 16, 2025 [–]

How does cycling out certificates more frequently reduce the load on HSMs?

timmytokyo on April 16, 2025 | | [–]

It's all relative. A 47-day cycle increases the load, but a 48-hour cycle would increase it substantially more.

woodruffw on April 17, 2025 | | [–]

Much of the HSM load within a CA is OCSP signing, not subscriber cert issuance.

Consider applying for YC's Summer 2026 batch! Applications are open till May 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact