vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-tls: leafValidityDays default 30 (per mara: ahead of the ~47-day proposal)

Browse source 
Short-lived leaf bounds the blast radius of a key compromise. Doc notes
the renewal caveat: re-sign is activation-only today, so a hive that
stays up >30 days without a rebuild would need a periodic re-sign timer
to avoid leaf expiry (follow-up).
This commit is contained in:
atlas 2026-06-23 00:22:55 +02:00 • committed by mara
commit 4e4e9f8a60
1 changed files with 15 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/modules/hive-tls.nix
View file

@ -63,20 +63,22 @@ in
leafValidityDays = lib.mkOption { leafValidityDays = lib.mkOption {
type = lib.types.int; type = lib.types.int;
default = 397; default = 30;
description = '' description = ''
Validity window of the gateway leaf cert in days (default 397). Validity window of the gateway leaf cert in days (default 30).
397 is just under the 398-day CA/Browser-Forum leaf cap, so Short-lived by design — ahead of the CA/Browser-Forum's move
browsers accept it without warning, while keeping the window toward ~47-day max lifetimes — which bounds the blast radius of a
short enough to bound the blast radius of a leaf-key compromise. leaf-key compromise. The leaf is re-signed by the (stable) CA
The leaf is re-signed by the (stable) CA when it is missing or when it is missing or near expiry; because it shares the CA
within 30 days of expiry; because it shares the CA anchor, a anchor, a rotation does not disturb consumer trust. Agents and
rotation does not disturb consumer trust. Agents and federation federation peers validate against the CA, not browser CA/B-forum
peers validate against the CA, not browser CA/B-forum limits. limits. NOTE: at this short a window the re-sign must run more
(The previous ~10y default was pointless given that auto-rotation often than the leaf lifetime. Today `hive-tls-ca` re-signs at
— and long enough to make browsers complain.) Keep this service activation (boot/rebuild) only — there is no periodic
comfortably above the gap between gateway rebuilds, since the re-sign timer yet — so a hive that does not reboot within the
re-sign runs at service activation, not on a standalone timer. validity window would let the leaf expire. Keep that in mind (or
add a re-sign timer) when running a hive that stays up for long
stretches without a rebuild.
''; '';
}; };
}; };