X509 Certificate Management Best Practices
In this video, Keytos Founder Igal Flegmann will run through best practices for X509 Certificate Management.
Hi! Welcome back to the Keytos PKI series where we teach you the basics about PKI. Today we're going to look at certificate management best practices. In the past, it used to be you had a handful of certificates. You used to have them in spreadsheet and rotate them every two years. Nowadays, that's not good enough. Even Apple doesn't even support certificates that are longer than a year. So, nowadays organizations have 50-100,000 certificates, which means you cannot have someone manually go and rotate those certificates. So, now you have to automate that certificate lifecycle, and rotate them often. One of the reasons is security. You don't want to have the same key for a long time in case that key gets compromised. You don't want to have to worry about someone using it, and someone not checking revocation, or something like that. Also, to make sure that the system is working. If you rotate often, then it's obviously going to be automated, and it's obviously going to have all the checks and balances to make sure it's working. So, the best practices are rotate all non-hardware protected certificates. So, that's any certificate it doesn't have their private key protected by an HSM. Every 30 days, rotate all computer leave certificates, at most every 90 days. So, even if they’re HSM backed, the best practice is to rotate them every 90 days and then, rotate all human certificates. So, if you're using a YubiKey or a smart card, maximum every one to two years. The reason for this is you don't want your revocation to get too big. So, let's say you do two years, and your average employee tenure is 1 year, all of a sudden you have half of your certificates being revoked and then you have a massive Crl that services have to download every time. So, keep human certificates short, and just have an easy way to rotate them for your humans. Those are the certificate management best practices, thank you for watching, and we'll see you in the next one!
Learn more about certificate management at www.keytos.io