TLS certificate validity is being shortened

TLS certificate validity is being shortened

What happened?

New validity periods

Motivation

1. OCSP (Online Certificate Status Protocol)
2. CRL (Certificate Revocation List)

IACBOX

1. IACBOX Standard Domain: (hotspot.internet-for-guests.com)
2. Standard Domain from White Label Partners: The associated certificate is automatically installed during registration with the partner theme and has been updated annually until now.
3. Custom Domain: Any custom domain registered by the administrator themselves, where the TLS certificate is also procured and installed by the administrator.

Update

Now let’s look at how the three cases will be handled in the future:

1. IACBOX Standard Domain: Nothing changes here regarding the type of update – the certificate for the standard domain (multiple domains in the future – see below) is automatically updated via the online update.
2. Standard Domain from White Label Partners: To guarantee the smoothest possible process, we offer white label partners the option for us to automatically update short-lived certificates and distribute them via our update servers. To do this, a partner only needs to create a special `CNAME` DNS entry so that we are authorized to update the certificate for these domains.
3. Custom Domain:
   • 3.1 If the certificate is to be updated on the IACBOX itself, this is only possible via the ACME DNS challenge. The IACBOX will receive an ACME client during the course of v24 that will make this possible.
   • 3.2 If the certificate is renewed externally, for example because it is a wildcard certificate also used on other systems, then in the future a certificate can also be installed via the Batch API. This allows certificates to be copied and installed on the IACBOX using simple scripts after their renewal.

How does automatic certificate renewal work?

The Let’s Encrypt initiative was a pioneer of automated certificate renewal. It made standard, domain-validated certificates available to everyone free of charge. These certificates currently apply for 90 days. The ACME protocol was invented for the automated issuance and renewal of certificates. ACME stands for Automatic Certificate Management Environment and is a protocol that allows certificates to be automatically created, managed, and updated. There are also proprietary automation methods from other CAs. However, ACME is an open standard supported by various CAs.

In order to validate a domain, you must prove that you own the domain and have control over the server or domain. Originally, ACME only supported the so-called HTTP challenge (= proof). This challenge works by placing a special file on the server, which the CA server then requests. If the file exists and has the correct content, the certificate is issued.

However, for servers like the IACBOX, which are usually connected to the network behind a firewall without a public IP address, this does not work, or at least not without port forwarding. Therefore, the DNS challenge was introduced later. This challenge works by creating a special DNS entry, which the CA server then retrieves. If the entry exists and the value matches, the certificate is issued.

To do this, however, the DNS provider used must provide an API through which DNS entries can be created and deleted.

Additional new standard domains

At this point, we can announce another innovation – there will soon be two new standard domains available for free that can be selected on every IACBOX. These new domains are shorter, which is particularly helpful for login links in emails and SMS. Furthermore, the IACBOX is also used in many locations where WiFi users cannot be referred to as “guests” (e.g., in hospitals). These new domains offer a more general name here and, through a wildcard certificate, also the possibility to determine the sub-domain yourself.

• *.iacbox.surf
• *.login.surf

The previous standard domain hotspot.internet-for-guests.com will remain for the medium term. However, the certificate for this domain will also be switched to a short-lived certificate in 2026.