“有效期”的目的是什么？在 X.509 证书中？
我已阅读 RFC 2459（Internet X.509 公钥基础设施证书和 CRL 配置文件）中我认为与此问题相关的部分。但是，我不太清楚证书的有效期（特别是到期日期）的目的是什么。
据我了解，证书的目的是以可验证的方式将公钥与身份绑定（在 X.509 中，通过证书颁发机构，或在 OpenPGP 中，通过信任网络）。因此，在我看来，证书从创建之时起一直有效，直到相应的私钥被泄露（或员工被解雇，或其他什么）为止，在这种情况下，它将被放入证书吊销列表中（我相信）。
在什么情况下这不是真的？为什么身份和公钥的绑定会突然失效呢？我知道大多数证书颁发机构都是商业企业，因此收取经常性费用是有利可图的，但我正在制作一个开源项目，它只需生成将服务器上的用户名与公钥绑定的证书（免费） ，用户的密码用于向 CA 验证其身份（当然，CA 存储其散列密码）。
I've read the parts of RFC 2459 (Internet X.509 Public Key Infrastructure Certificate and CRL Profile) that I believed to be relevant to this question. However, I'm not totally clear on what the purpose of the validity period (specifically the expiration date) of the certificate is.
It's my understanding that the purpose of a certificate is to bind a public key to an identity in a way that can be verified (in X.509, through a certificate authority, or in OpenPGP, through a web of trust). Therefore, it seems to me like a certificate would be valid from the time it is created until the time the corresponding private key is compromised (or an employee is fired, or whatever), in which case it would be put on a certificate revocation list (I believe).
Under what circumstances is this not true? Why would the binding of an identity to a public key suddenly become invalid? I know that most certificate authorities are commercial enterprises and therefore it would be profitable to have a recurring fee, but I'm making an open source project that simply generates certificates (at no cost) that bind a username on the server to a public key, and the password of the user is used to verify his identity to the CA (which, of course, stores his hashed password).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这个想法是为了减少私钥被泄露的机会之窗。只有当受害方知道这一点时才可以撤销。此外，现有的撤销机制并不完全可靠，因此最好有一个固定的到期日期。
The idea is to reduce the window of opportunity in case the private key gets compromised. Revocation is possible only if the compromised party is aware of that. Also, the existing revocation mechanisms are not completely reliable, so it's good to have a fixed expiration date.
我很确定您已经回答了有关商业方面的问题。但我会在这里再扔一个。
这在一定程度上是为了在您不知道它曾经丢失的情况下防止损失。换句话说，只有当有人知道它被泄露时，它才会出现在证书吊销列表中。在很多情况下，您不会知道它已被泄露，因此最好有办法强制刷新密钥。
这有点像过去间谍使用每天都在变化的密码。这并不是说他们认为旧密钥已被泄露，而是因为他们不知道密钥是否已被泄露，所以他们进行了更改。
另一个例子是让您的密码每 90 天左右过期。它不会过期，因为已知它已丢失；如果它丢失而您不知道，它就会过期。
I'm pretty sure you answered your own question with regards to the commercial aspect. But I'll throw another one in here.
This is to, in part, protect against losses when you have no idea that it was ever lost in the first place. In other words, the only time it will show up on a certificate revocation list is if someone knows it was compromised. There are many cases in which you won't know it was compromised so it's good to have a way to force a refresh of the key.
It's kind of like the old days where a spy used a cipher that changed on a daily basis. It wasn't that they thought the old keys were compromised, they changed because they had no idea if the keys were compromised.
Another example is having your password expire every 90 days or so. It's not expiring because it is known to have been lost; it's expiring in case it was lost and you don't know it.