Hacker News Reader

Doesn't the first Apple link specifically say the 398-day limit doesn't apply to self-signed CAs?

> This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS.

> This change will not affect certificates issued from user-added or administrator-added Root CAs.

The second link about the other restrictions (including <=825 days validity) does appear to apply to all CAs.

View on HN

And yet, my homegrown root CA cert with 3650 days of validity hums along just fine...

[edited: but since I also want to have host certs that are on various internal servers, the short validity applies to them]

I am not sure if the same rules apply to 802.1x authentication, but we use self signed certs with 2 year validity for EAP-TLS and have never had any issues on iOS devices

Reply on news.ycombinator.com