What are short-lived certificates?

Short-lived certificates are digital certificates with a brief validity period, designed to enhance cybersecurity by expiring quickly. These certificates play a pivotal role in identity-based infrastructure access, granting access to computing resources for a limited time. Typically issued by a certificate authority (CA), these certs are configured with a specific validity period—often just enough to perform the required tasks. They contain metadata defining the permissions the entity is authorized to utilize, effectively minimizing the attack surface by reducing the window in which an attacker can misuse a compromised certificate and get access to a protected resource.

Short-lived certificates leverage encryption technologies such as Transport Layer Security (TLS) and Secure Sockets Layer (SSL) to establish secure connections. Public Key Infrastructure (PKI) underpins this system, utilizing a key pair (public key and private key) for authentication.

Managing Short-Lived Certificates: Automation and APIs

Companies who are using short-lived TLS certificates internally may rely on public certificate authorities such as Let’s Encrypt that issue certificates, in tandem with automation and API integration with DevOps workflows. APIs facilitate seamless integration with existing processes, allowing for the automatic issuance of a new certificate with a short certificate lifetime, minimizing downtime and latency. However, issuance of certificates in this way often presents an administrative and certificate management challenge, often resulting in rogue issuance use cases in developer teams that is taking place outside of corporate certificate policy. Further, most short-lived certificates issued by public certificate authorities are still measured in days, and are subject to online certificate status protocol (OCSP) and certificate revocation list (CRL) verification and revocation schemes.

Teleport's Take

Teleport operates a certificate authority as part of its architecture, removing the need for companies to manage certificate issuance directly or through a discrete 3rd party certificate authority, while providing companies with the benefits of leveraging cryptography and cryptographic identity as the underlying basis for their authentication and authorization processes. Teleport’s short certificate validity periods ensure that engineers only have privileged access to the infrastructure they need for the period of time during which they are completing a project. By eliminating standing privileges, Teleport minimizes attack surface by reducing the window that an attacker has to compromise access and by preventing lateral movement on the network using overprivileged accounts or standing privileges to gain access to other resources.

Learn More

• Teleport Blog: Certificate-Based Authentication Best Practices
• Teleport Blog: Comparing Passwordless SSH Authentication Methods
• Dark Reading: GoDaddy Breach Exposes SSL Keys