Comment

Comment by tialaramex

Timestamping does exist but it isn't used in the Web PKI (what you're calling "TLS certificates")

Both backdating and forward dating have been done in the Web PKI for various reasons, both legitimate (e.g. historically if you couldn't randomise serial numbers enough it was acceptable to randomise the notBefore time parameters slightly, this is no longer allowed) and illegitimate (we have pretty good circumstantial evidence that StartCom issued SHA-1 certificates long after such issuance was forbidden, probably for $$$ from companies that realised they should have bought one before the cut-off) but there is no inclination to insist upon timestamping to try to prevent that.

The most likely place you'll see timestamping in arguably publicly trusted certificates is code signing.

parent tialaramex 5 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton