Re: [webrtc-pc] Strengthen generateCertificate expires capping (#2137)

To elaborate, I believe just switching from *MAY* to *MUST* would not add any value if there's no concrete guideline. This is what I was arguing about in the above comments.

Going back to what @martinthomson stated:

> Because browsers (or the users they act for) might not be well served by long-lived keys. And an expiration encourages/forces sites to deal with key changes. Maybe one days we will want to cleanly change requirements for keys and algorithms. Having keys expire prepares the ecosystem for that being something less than a massive disruption.

Based on that, it may make sense to say *MUST limit to less than or equal to X but MAY go below that*. Maybe I misinterpreted your previous comments and this is what you proposed.

IIRC @steely-glint makes use of this feature, so maybe he wants to add his two cents.

-- 
GitHub Notification of comment by lgrahl
Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/2137#issuecomment-475779740 using your GitHub account

Received on Friday, 22 March 2019 20:55:40 UTC