Impact of Reduced TLS Certificate Lifetimes on CA-Signed SAML Certificates

[Cantor, Scott]

> I’d appreciate any insights and comments on the potential
> impact of this 47-day move on the IdPs/SPs using common CA
>-signed certificates. 

I really suspect you know the answer and you're hoping you're missing something, but you're not.

If you're asking if there will be insane IdPs or SPs that decide, well, I guess we have to change our key every 47 days? Yes, I think so. I no longer trust in even a modicum of common sense in this industry, if I ever did.

Obviously for pragmatic reasons, I expect far more SPs to pull that than IdPs will because the pain of changing keys is much more acute for IdPs.

You're presumably asking from an SP perspective, so not trying to be mean, but you do know that it's the SPs that pull this far more often right?

> For example, if an IdP or SP uses a DigiCert certificate, will the
> maximum lifetime of the certificate have to be reduced to 47
> days in a few years? 

I do not see a likely scenario where CAs start issuing "SAML" certificates, and thus subject them to different policies. They do not issue certificates today that have any sensible use in SAML. Anybody doing that is misusing them and on some pedantic level asserting something the CA never intended them to assert about the key.

-- Scott