TLS Certificates – Validity Periods to Be Reduced

What happened?

New validity periods

Motivation

1. OCSP (Online Certificate Status Protocol)
2. CRL (Certificate Revocation List)

IACBOX

1. IACBOX Standard Domain: (hotspot.internet-for-guests.com)
2. Standard Domain of White-Label Partners: The associated certificate is automatically installed when registering with the partner theme and has so far been updated annually.
3. Custom Domain: Any custom domain registered by the administrator, who also procures and installs the TLS certificate themselves.

Update

Let’s now look at how these three cases will be handled in the future:

1. IACBOX Standard Domain: Here, the update method remains unchanged – the certificate for the standard domain (soon to include multiple domains – see below) will continue to be updated automatically via the online update.
2. Standard Domain of White-Label Partners: To ensure a smooth process, we offer White-Label partners the option to have short-lived certificates automatically updated and distributed via our update servers. To enable this, a partner only needs to create a special `CNAME` DNS entry, allowing us to update the certificate for these domains.
3. Custom Domain:
   • 3.1 If the certificate is to be updated on the IACBOX itself, this is only possible via the ACME DNS challenge. The IACBOX will receive an ACME client during version 24 to enable this.
   • 3.2 If the certificate is renewed externally, for example, because it is a wildcard certificate used on other systems, a certificate can also be installed via the Batch API in the future. This allows certificates to be copied and installed on the IACBOX using simple scripts after their renewal.

How does automatic certificate renewal work?

The Let’s Encrypt initiative was a pioneer in automated certificate renewal. It made regular, domain-validated certificates freely available to everyone. These certificates are currently valid for 90 days. The ACME protocol was invented for the automated issuance and renewal of certificates. ACME stands for Automatic Certificate Management Environment and is a protocol that enables certificates to be automatically created, managed, and updated. Other CAs also offer proprietary automation methods, but ACME is an open standard supported by various CAs.

To validate a domain, you must prove that you own the domain and control the server or domain. Originally, ACME only supported the so-called HTTP challenge (= proof). This challenge works by placing a special file on the server, which the CA server then queries. If the file exists and has the correct content, the certificate is issued.

For servers like the IACBOX, which are often behind a firewall on the network without a public IP address, this does not work or at least not without port forwarding. Therefore, the DNS challenge was introduced later. This challenge works by creating a special DNS entry, which the CA server then retrieves. If the entry exists and the value matches, the certificate is issued.

However, the DNS provider used must provide an API through which DNS entries can be created and deleted.

Additional new standard domains

At this point, we are pleased to announce another innovation – there will soon be two new standard domains available for free on every IACBOX. These new domains are shorter, which is especially helpful for login links in emails and SMS. Furthermore, the IACBOX is also used in many locations where WLAN users cannot be referred to as “guests” (e.g., in hospitals). These new domains offer a more general name and, through a wildcard certificate, also allow you to define the subdomain yourself.

• *.iacbox.surf
• *.login.surf

The previous standard domain hotspot.internet-for-guests.com will remain available for the time being. However, the certificate for this domain will also be switched to a short-lived certificate in 2026.