[Moderator’s note: This thread is continued at Pros and cons of 90-day certificate lifetimes. If you’d like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) that thread.] What will the minimum (such as if I want to explicitly request a short lifetime) and maximum lifetime for certificates be?

I hope there is a half life technique like in DHCP so that the cert gets renewed BEFORE it expires. And if renewal fails there is plenty of time to resolve the issue BEFORE the current cert expires.

Is certificate renewal something we can automate with the letsencrypt client tool (that sort of defeats the point, doesn’t it?) or will it require manual labor on the part of users? 90d is really, really short. CAcert does 6 months for unverified accounts and even that has been a pain for me.

The default behavior of the Let’s Encrypt client is to automatically renew all certs that it has installed in a server (so not certs obtained in standalone or manual mode, but generally other certs).

There are a couple of reasons for the short lifetime. Our goal is to increase HTTPS usage on the Internet. Part of that goal is decreasing the incidence of avoidable certificate errors, like expiration. Since expiration errors are very commonly caused by human failure, we want to encourage people to automate renewal of their certificates. A ninety day certificate lifetime is a part of that encouragement. However, for people who still would like to manage certificates manually, I think there is a good argument that a person gets better at a task they have to do six times a year than one they have to do once a year. People are less likely to make mistakes, and more likely to set up reminders and make sure there is backup for when they are on vacation. @questiontradition: The stock Let’s Encrypt client is configured to attempt renewal at the sixty day mark, with thirty days left before expiry. If it fails, it will send email and the system operator will have a month in which to intervene and correct any problems.

Would like to recommend and request a positive renewal confirmation as well. If a renewal fails, the cause may be common to causing an email notification failure as well. So absence of a confirmation is a heads up that human action is needed to resolve an issue.

[image] jsha: The stock Let's Encrypt client is configured to attempt renewal at the sixty day mark, with thirty days left before expiry. If it fails, it will send email and the system operator will have a month in which to intervene and correct any problems. And when will it revoke the old certificate?

And what about domain revalidation? Is this done at every renewal (so every 60-90 days) or only once a year e.g.? And is this completely automated too in this case?

In this case, the old certificate will just be allowed to expire at its original expiration date. The CA will not revoke the prior certificate as a result of the issuance of the new certificate. Revocation is treated as an exceptional case, not a routine case, so it should happen when something bad or improper takes place, or when the client explicitly requests it.

Thanks for the fantastic explanation! This would be good to mention on https://letsencrypt.org/howitworks/ or https://letsencrypt.org/howitworks/technology/.

[image] ac000: why does it need to expire at all, wasn't that just a money making scheme? Certificates need to expire because domains change hands all the time. If certificates did not expire, there would be a huge number of certificates out there controlled by people who no longer owned the domains.

Maximum (and minimum) certificate lifetimes?

Issuance Policy

rugk August 21, 2015, 3:29pm 12

And when will it revoke the old certificate?

Topic		Replies	Views
Pros and cons of 90-day certificate lifetimes Issuance Policy	443	102229	February 6, 2017
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4767	December 22, 2018
90 day expiration Feature Requests	31	1093	February 25, 2025
[Poll] Do we need longer cert validity times? Issuance Policy	49	10417	April 10, 2016
Getting Bad Vibes Uncategorized	80	23242	November 26, 2016

Maximum (and minimum) certificate lifetimes?

Related topics