Frequently Asked Questions
Why has the lifetime of certificates been shortened further and further in recent years?
Whenever a security problem with certificates is discovered, the rules for certificates are adjusted and tightened accordingly. However, the new rules do not apply retroactively, i.e. they only apply to certificates that were created after the new rules have already come into force. Certificates that are older must still be accepted as valid, even if they were created according to older rules.
The longer an old certificate remains in circulation, the more likely that someone with the appropriate knowledge and skills will come across it and then exploit its security problem. Therefore, you don't want to have long terms, because if a certificate has to be renewed, it must always be renewed in accordance with the current applicable rules and this happens sooner, the shorter its term is. In the past, the runtimes were too long, but this had led to problems several times when RSA was cracked with 768 bits or when a method was found to create SHA-1 collision, which means that signatures based on SHA-1 all at once could be forged. Back then, it took far too long until insecure certificates were no longer in circulation, which resulted in various avoidable attacks.
By the way, renewing only affects the gateway certificate. User certificates do not need to be renewed if you exchange the certificate at the gateway. Users also do not need a new configuration. In fact, users don't even notice such an exchange. On web servers today, this usually happens automatically and even more often, as web certificates are often only valid for a maximum of 90 days.