From 5ed0288634b0d4312a3014c6f01aa46a46394688 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 23 Jun 2026 00:11:30 +0200 Subject: [PATCH] hive-tls: default leafValidityDays to 397 (was 3650/~10y) A 10-year leaf is pointless given the leaf auto-rotates (re-signed within 30 days of expiry) and is long enough to make browsers warn. 397 days sits just under the 398-day CA/Browser-Forum leaf cap (so browsers accept it) while bounding the blast radius of a leaf-key compromise. The re-sign runs at service activation (hive-tls-ca is a oneshot, no timer), so 397 stays comfortably above any gateway rebuild gap. --- nix/modules/hive-tls.nix | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix index e2a6d791..c50d960e 100644 --- a/nix/modules/hive-tls.nix +++ b/nix/modules/hive-tls.nix @@ -63,14 +63,20 @@ in leafValidityDays = lib.mkOption { type = lib.types.int; - default = 3650; + default = 397; description = '' - Validity window of the gateway leaf cert in days (default ~10y). + Validity window of the gateway leaf cert in days (default 397). + 397 is just under the 398-day CA/Browser-Forum leaf cap, so + browsers accept it without warning, while keeping the window + short enough to bound the blast radius of a leaf-key compromise. The leaf is re-signed by the (stable) CA when it is missing or within 30 days of expiry; because it shares the CA anchor, a - rotation does not disturb consumer trust. Browsers may warn on - long-lived leaves, but agents and federation peers validate - against the CA, not browser CA/B-forum limits. + rotation does not disturb consumer trust. Agents and federation + peers validate against the CA, not browser CA/B-forum limits. + (The previous ~10y default was pointless given that auto-rotation + — and long enough to make browsers complain.) Keep this + comfortably above the gap between gateway rebuilds, since the + re-sign runs at service activation, not on a standalone timer. ''; }; };