6 day certificates!? Pinch me I'm dreaming

Hardly; I think they work pretty hard on keeping things up, though.

I think the main push toward really-short lifetime certificates (and thereby not needing to worry about revocation) isn't as much about client private keys, as being able to deal quickly with a CA that broke a rule (usually accidentally) that means that one shouldn't rely on the certificates. I may be wrong on that, though.

I'd say that anyone that actually cares about production availability should already be using certificates from multiple CAs. One doesn't just need to worry about getting new certificates, but uptime for CRL/OCSP and such as well (at least for the classic longer-than-a-week certs). One of the main things that Let's Encrypt has done for the world is pushing for ACME to be a standard, so now anyone can easily switch to another CA just by pointing their client to another CA endpoint.

Current popular free CAs include BuyPass GO, Google, and ZeroSSL. The developer of Certify the Web has a list comparing some, and the publisher of Posh-ACME has their own list.

The most public case I know of is Wikipedia (and the rest of Wikimedia), which has some public documentation though there might be a better link somewhere. They make sure that all their data centers have all certificates loaded, with different datacenters having a different primary one running so that they know all their certs "work" (since they're all being used for live traffic), and are ready to easily switch to another in case one CA has an OCSP outage or other problem.

6 Likes