Skip to content

Trust Agility in an Era of Transient Ties: Rethinking TLS Trust in a Rapidly Evolving Ecosystem#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025

Recording

Hoss Shafagh, Netflix (Enigma track) — Core

Play the recording: Trust Agility in an Era of Transient Ties: Rethinking TLS Trust in a Rapidly Evolving Ecosystem

  • Why: A practitioner-level look at the most consequential near-term shift in the Web PKI — root programs shortening server certificate lifetimes to a maximum of 47 days by 2029 — from someone who runs PKI and workload-identity infrastructure at Netflix scale, not a standards document.
  • What: An argument for "trust agility" — the ability to rapidly and securely update trust relationships as certificate authorities, cryptographic standards, and threat models evolve — as the operational response to shortening cert lifetimes, slower-upgrading consumer devices, and growing non-browser (machine-to-machine, workload identity) use cases that fall outside traditional browser trust models. (from abstract only)
  • How: Draws on real-world PKI operations at Netflix to describe automation and lifecycle-aware certificate management strategies across diverse endpoints, including preparing for post-quantum cryptographic transitions. (from abstract only)
  • Where applicable: Anyone operating PKI/TLS infrastructure at scale, workload-identity systems, or IoT/embedded fleets with slow upgrade cycles; general but grounded in a large-scale production environment.