Using short-lived certificates to protect TLS secrets

This post details the implementation of Short-Lived Certificates (SLCs) for TLS private keys on Meta's edge networks. It describes the evolution of their TLS infrastructure from long-lived certificates to daily rotation, addressing challenges like certificate revocation, remote offload latency, and the need for robust automation. Key technical contributions include the ConfigBuilder for reliable certificate issuance and distribution, a prev-current-next model for rotation to handle synchronization delays, and a staged rollout process for validation. The system manages certificate issuance with a few months' lifespan but distributes them 10 days before expiration, and rotates them daily, limiting private key exposure to 10 days. The post also discusses scaling challenges, such as overloading secret stores during rotation, and the solutions implemented, including caching and staggered secret fetches.