[TLS] Re: [External⚠️] Re: Certificate Update in TLS

[Viktor Dukhovni <[e-mail]>]

On Sun, Jun 22, 2025 at 03:53:15PM +0100, Yaroslav Rosomakho wrote:

> Overall, correct implementation of creating a new TLS session, carefully
> moving traffic and not introducing new stability or security risks is
> extremely complex in large scale distributed systems. Extended Key Update
> and Certificate Update enable long-lasting TLS 1.3 connections in a much
> simpler and more secure way.

This appears to be the case at first blush, but I wonder which is more
likely:

    - The key was already compomised when the connection was first
      established, and a later failure to perform certificate update
      helps to limit the duration of a compromise of which the node
      operator might not otherwise have been able to learn in a
      similarly timely manner.

    - The key was fine when the connection was established, but a
      problem with a subsequent certificate rollover resulted in
      a failure of certificate update that tears down a working
      session.

My money is on the second, and also that in environments where such
long-lived connetions are highly desirable, either both nodes are
under the control of a single operator, or the operators know each
other and key compromise can be communicated effectively out of
band, perhaps faster than revocation happening via CAs.

So I am concerned that the proposed mechanism is likely to reduce
rather than increase the availability of these long-term sessions.

-- 
    Viktor.