Google Chrome limits the validity of SSL Certificates to one year

[stesch79]

Dear Edge developers

Google has recently announced to limit the validity of certificate to one year (398 days) starting in September 2020 (see https://www.certisur.com/en/google-chrome-limits-the-validity-of-ssl-certificates-to-one-year/)

Is this already planned to be addressed in Edge Chromium?

If yes, will there be a policy to exclude certain domains from this validation?

Background: In our company we use 2 year certificates (released by our internal PKI) and we want to understand the impact once the new validity check is available in Edge Chromium as well.

Regards,

Stephan

[#2 · Accepted solution]

@stesch79 These changes apply to certificates that are rooted to a public CA trust anchor. Certificates that are rooted to a private PKI CA (“locally-trusted anchor”) are not limited this way.

See also https://source.chromium.org/chromium/chromium/src/+/master:net/docs/certificate_lifetimes.md?q=certi...

[#3]

@Eric_LawrenceThanks for the link! That's reassuring!

But what about the validity check itself? I assume Edge Chromium will also implement that check sooner or later?

[#4]

Yes, for certificates that chain to public CAs, we will have the same check as Chrome, shipping in the same Stable version.

[#5]

And company internal CA‘s are not affected?

[#6]

@ThiloLangbein - Certificates that are rooted to a private PKI CA (“locally-trusted anchor”, which is trusted only because the user or admin added it to the client) are not limited this way.

It is extremely rare for a company to have an internal CA that chains back to a publicly trusted root (although it is not impossible. Microsoft has such a CA, as does at least one of the major CA companies).

[#7]

@Eric_Lawrence  

Can you please confirm on what happens to 

1. Mobile Applications using SSL Pinning feature.
2. Installed Mobile Applications using channel encryption (using TLS based communication )
3. Clients like Cisco AnyConnect using Internal CA issued User Certificate but the Target VPN Services would be Public Certificates.

[#8]

I don’t think any of these topics are related to the TLS cert validity change.

1. Mobile Applications using SSL Pinning feature.

This isn’t a question for Microsoft but for Apple/Google. Both iOS and Android platforms will probably impose the lifetime limit for certificates across the whole OS. Pinning can be implemented in different ways, but that’s not really related to the certificate lifetime.

2. Installed Mobile Applications using channel encryption (using TLS based communication )

This is fundamentally the same question as #1.

3. Clients like Cisco AnyConnect using Internal CA issued User Certificate but the Target VPN Services would be Public Certificates.

It’s not really clear what is meant here; a User Certificate sounds like you’re talking about a Client Certificate; this change applies to TLS server certificates.

[#9]

@Eric_Lawrence I have a similar question . We also use Cisco AnyConnect using Internal CA  and issued User certificate  EKU client authentication (User Template) and  our VPN appliances uses internal CA  as well EKU server authentication certificate (WebServer template) . Can you please confirm what happens with the validity  check in this case?

Thanks

[#10]

Internal CAs not chained to a public root do not change.
Client authentication certificates do not change.