What happened to personal freedom of letting people choose for themselves how long a certificate should last? Not really liking this trend of large companies making decisions for others and then forcing them on everyone.
These "large companies" put restrictions on what certificate authorities are allowed to do so that they can keep their users safe.
I dislike not being able to choose my SSL lifetime for the same reason I do not like a web browser deciding for me if I can use my own CA. In both cases choices are being made for me, whether I like them or not.
"You can't install that, it might be a virus!"
What browser does not allow you to load your own trusted CA?
other decisions they've made on this topic that you can disagree with if you care:
- ciphers
- hashes
- CAs
- revocation systems
etc
And what about the right for users to privacy and security, when there's no drawback on the host other than their misguided sense of "freedom"?
However, there is the https-only movement to prevent web browsers from viewing my website, because it it not https and therefore not 'safe'.
This movement overlaps pretty well with the people who don't accept other different certificate authorities.
Like i said, nothing is stopping you from doing whatever you want other than the fact that other people might not like it, and might choose to treat your website differently. Just like you can choose not to use https, other people can choose not to like sites that don't use https. Freedom goes both ways.
There is a big difference between "nothing is stopping you from starting an exercise program" and "nothing is stopping you from being the ruler of the planet" even though the construction is the same.
Certificates are particularly painful because it sometimes seems that every program that needs them has its own way to find them. I can't just install in one OS-wide store and say that it should work just like the certificates from the major certificate authorities.
No, I have to install it in Chrome and Firefox. Oh and I've got some Python scripts and some Perl scripts and some PHP scripts that need it, so I've got to put it where they want. And let's not forget curl and wget. And how about thing I'm running in a VM or under Docker? Or database clients.
Your actual problem is that the browser vendors (who decide which certs should live in the root store) have certain criteria which CAs need to meet in order to be trusted.
Why should Firefox / Chrome / etc. have to honour your desire that your arbitrary-length lifetime certs are trusted by default in their browsers? You still have the personal freedom of installing your own CA root if you like.
No such law is being proposed. The cops aren't going to bust down your door for generating a 3650 day certificate using openssl.
Passport max validity length is set by the ICAO not the government.
Contracting states are free to do whatever they like but for the most part, they choose to follow the Recommended Practices.
https://www.icao.int/WACAF/Documents/Meetings/2018/FAL-IMPLE...
The depends where you live, and what the government means. In some places the validity of a passport is written in a law, voted by the parliament; in other it's a operation decision by the government (e.g. the ministry of the internal affairs).
Where I live it's a law voted by the parliament.
Also TLS fingerprints and biometrical data are "hashed" data, if that's what you mean about having in common.
They're both centrally revokable, attested assertions of identity, where the attestation can be validated with the attester offline.
If you try and come up with a design for any system that includes this type of assertion, you'll end up in a place where you'll probably want it to expire and need re-validation at some point. That expiry is a property of the attestation, and is therefore controlled by the person/group doing the attestation. In the case of a passport, this happens to be the government. For a cert, it's the CA.
Oddly enough, virtually all passport/personal ID checks around here are... online. Airports, police, any shop... all of them are all online.
The CAB forum is not a company (although it is made up of some) and the government does not set passport max validity lengths (they can make it shorter than 10 years, just like CAs can make certs shorter, but there is a reason no country gives out passports longer than 10 years)