vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-tls: default leafValidityDays to 397 (was 3650/~10y)

Browse source 
A 10-year leaf is pointless given the leaf auto-rotates (re-signed
within 30 days of expiry) and is long enough to make browsers warn.
397 days sits just under the 398-day CA/Browser-Forum leaf cap (so
browsers accept it) while bounding the blast radius of a leaf-key
compromise. The re-sign runs at service activation (hive-tls-ca is a
oneshot, no timer), so 397 stays comfortably above any gateway
rebuild gap.
This commit is contained in:
atlas 2026-06-23 00:11:30 +02:00 • committed by mara
commit 5ed0288634
1 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/modules/hive-tls.nix
View file

@ -63,14 +63,20 @@ in
leafValidityDays = lib.mkOption { leafValidityDays = lib.mkOption {
type = lib.types.int; type = lib.types.int;
default = 3650; default = 397;
description = '' description = ''
Validity window of the gateway leaf cert in days (default ~10y). Validity window of the gateway leaf cert in days (default 397).
397 is just under the 398-day CA/Browser-Forum leaf cap, so
browsers accept it without warning, while keeping the window
short enough to bound the blast radius of a leaf-key compromise.
The leaf is re-signed by the (stable) CA when it is missing or The leaf is re-signed by the (stable) CA when it is missing or
within 30 days of expiry; because it shares the CA anchor, a within 30 days of expiry; because it shares the CA anchor, a
rotation does not disturb consumer trust. Browsers may warn on rotation does not disturb consumer trust. Agents and federation
long-lived leaves, but agents and federation peers validate peers validate against the CA, not browser CA/B-forum limits.
against the CA, not browser CA/B-forum limits. (The previous ~10y default was pointless given that auto-rotation
— and long enough to make browsers complain.) Keep this
comfortably above the gap between gateway rebuilds, since the
re-sign runs at service activation, not on a standalone timer.
''; '';
}; };
}; };