vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-tls: leafValidityDays default 30 (per mara: ahead of the ~47-day proposal)

Browse source 
Short-lived leaf bounds the blast radius of a key compromise. Doc notes
the renewal caveat: re-sign is activation-only today, so a hive that
stays up >30 days without a rebuild would need a periodic re-sign timer
to avoid leaf expiry (follow-up).
This commit is contained in:
atlas 2026-06-23 00:22:55 +02:00 • committed by mara
commit 4e4e9f8a60
1 changed files with 15 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/modules/hive-tls.nix
View file

@ -63,20 +63,22 @@ in
leafValidityDays = lib.mkOption {
type = lib.types.int;
default = 397;
default = 30;
description = ''
Validity window of the gateway leaf cert in days (default 397).
397 is just under the 398-day CA/Browser-Forum leaf cap, so
browsers accept it without warning, while keeping the window
short enough to bound the blast radius of a leaf-key compromise.
The leaf is re-signed by the (stable) CA when it is missing or
within 30 days of expiry; because it shares the CA anchor, a
rotation does not disturb consumer trust. Agents and federation
peers validate against the CA, not browser CA/B-forum limits.
(The previous ~10y default was pointless given that auto-rotation
— and long enough to make browsers complain.) Keep this
comfortably above the gap between gateway rebuilds, since the
re-sign runs at service activation, not on a standalone timer.
Validity window of the gateway leaf cert in days (default 30).
Short-lived by design — ahead of the CA/Browser-Forum's move
toward ~47-day max lifetimes — which bounds the blast radius of a
leaf-key compromise. The leaf is re-signed by the (stable) CA
when it is missing or near expiry; because it shares the CA
anchor, a rotation does not disturb consumer trust. Agents and
federation peers validate against the CA, not browser CA/B-forum
limits. NOTE: at this short a window the re-sign must run more
often than the leaf lifetime. Today `hive-tls-ca` re-signs at
service activation (boot/rebuild) only — there is no periodic
re-sign timer yet — so a hive that does not reboot within the
validity window would let the leaf expire. Keep that in mind (or
add a re-sign timer) when running a hive that stays up for long
stretches without a rebuild.
'';
};
};