Edge Cache and CDN Platform · View 28 of 29 · 7 · Assurance
Decisions
- Every PoP has its own key pairs and its own certificates for the same names. A compromise revokes that PoP's certificates only, and no property needs reissuing anywhere else.
- Certificates last 14 days and are renewed at day 5, so every PoP starts any control-plane outage with at least 9 days left. That covers the 7-day autonomy requirement with margin, and the alert at day 8 leaves time for many renewal attempts.
- Keys are sealed to the node's TPM on disk and held in plaintext only in memory. A drive pulled from a rack is useless; a whole server taken while running is useful for at most 14 days.
Rejected for now
- Keyless termination adds a network round trip to every full handshake and makes the key server a dependency of the serving path. It is planned for Phase 3 for the few properties whose threat model justifies it.
- Delegated credentials are not supported by enough browsers to rely on.
Risks
- Certificate revocation checking is weak in browsers. The real limit is the 14-day lifetime, which is why it is short. It also means the public CA's issuance volume and rate limits must be contracted, not assumed.
