Re: [TLS] Question to TLS 1.3 and certificate revocation checks in long lasting connections

[Viktor Dukhovni <[e-mail]>]

On Sat, Mar 06, 2021 at 12:11:25AM -0600, Nico Williams wrote:

> On Fri, Mar 05, 2021 at 04:46:15PM -0800, Eric Rescorla wrote:
> > This leaves us with the case where Bob's certificate is no longer valid but
> > Bob has a new certificate [0]. In this case, just re-validating does not
> > help. Does that happen so often that we need protocol machinery other than
> > just tearing down the connection and starting over?
> 
> Probably not.  I've seen 5 day server certificates in use.  And while
> it's possible to keep connections open that long or longer, as Viktor
> points out, if you do keep a connection open and active longer than that
> and the server is still there (i.e., some node has its address and the
> connection's traffic keys), then that's probably good enough evidence
> that the server is still valid and still would have a fresh cert if you
> were to reconnect to it.

In general, I think breaking an established connection just to
reauthenticate the server only needlessly risks occasionally finding an
expired certificate that someone forgot to renew.  Server certificates
good at time of connection establishment should, barring extraordinary
circumstances be good for the life of the connection.

I suspect that in at least some cases the motivation to revalidate the
server certificate is only requested because it could be done in
principle, and ticks some checkbox about using CRLs, because they
exist, rather than from a clear threat this addresses.

However, it is possible that there actually exist use-cases where this
makes some sense, and that case, If connection lifetimes would otherwise
last unacceptably long, make a new connection, and close the old (in
some appropriate order).

-- 
    Viktor.