Lesson 1.53: Certificate inventory and shrinking lifetimes
Expired certificates cause outages that look like attacks, and weak old certificates linger for years on printers and forgotten servers. Both come from not knowing what you have. Public TLS certificates are also getting shorter: under CA/Browser Forum ballot SC-081 the maximum lifetime fell to 200 days in March 2026, falls to 100 days in March 2027 and to 47 days in March 2029, which makes manual renewal impossible. In the lab you sweep Northwind's certificate inventory with openssl: what has expired, what expires within 30 days, which use weak keys or SHA-1, and which are still renewed by hand.
16 min
You will learn to
- Explain why certificate inventories matter
- Find expired and soon-expiring certificates with -checkend
- Spot weak keys and SHA-1 signatures
- Explain the CA/B Forum validity reductions
- Plan automation (ACME)
Key terms
- Certificate inventory
- A list of every certificate in use: where, owner, issuer, expiry, algorithm, renewal method.
- -checkend N
- openssl x509 option: exit 1 if the certificate expires within N seconds.
- ACME
- Automatic Certificate Management Environment (RFC 8555): protocol for automated issuance and renewal.
- CA/Browser Forum
- The body of CAs and browser makers that sets the Baseline Requirements for public TLS certificates.
- SHA-1 signature
- Certificate signatures with SHA-1, broken by practical collisions (SHAttered, 2017); not accepted by browsers.
← Randomness and keys · All lessons · A zero-day on an edge device →