[Moderator’s note: This thread is continued at Pros and cons of 90-day certificate lifetimes . If you’d like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) that thread.] What will the minimum (such as if I want to explicitly request a short lifetime) and maximum li…

I hope there is a half life technique like in DHCP so that the cert gets renewed BEFORE it expires. And if renewal fails there is plenty of time to resolve the issue BEFORE the current cert expires.

Is certificate renewal something we can automate with the letsencrypt client tool (that sort of defeats the point, doesn’t it?) or will it require manual labor on the part of users? 90d is really, really short. CAcert does 6 months for unverified accounts and even that has been a pain for me.

The default behavior of the Let’s Encrypt client is to automatically renew all certs that it has installed in a server (so not certs obtained in standalone or manual mode, but generally other certs).

There are a couple of reasons for the short lifetime. Our goal is to increase HTTPS usage on the Internet. Part of that goal is decreasing the incidence of avoidable certificate errors, like expiration. Since expiration errors are very commonly caused by human failure, we want to encourage people to…

Would like to recommend and request a positive renewal confirmation as well. If a renewal fails, the cause may be common to causing an email notification failure as well. So absence of a confirmation is a heads up that human action is needed to resolve an issue.

[image] jsha: The stock Let's Encrypt client is configured to attempt renewal at the sixty day mark, with thirty days left before expiry. If it fails, it will send email and the system operator will have a month in which to intervene and correct any problems. And when will it revoke the old c…

And what about domain revalidation? Is this done at every renewal (so every 60-90 days) or only once a year e.g.? And is this completely automated too in this case?

In this case, the old certificate will just be allowed to expire at its original expiration date. The CA will not revoke the prior certificate as a result of the issuance of the new certificate. Revocation is treated as an exceptional case, not a routine case, so it should happen when something bad …

Thanks for the fantastic explanation! This would be good to mention on https://letsencrypt.org/howitworks/ or https://letsencrypt.org/howitworks/technology/ .

[image] ac000: why does it need to expire at all, wasn't that just a money making scheme? Certificates need to expire because domains change hands all the time. If certificates did not expire, there would be a huge number of certificates out there controlled by people who no longer owned the …

Maximum (and minimum) certificate lifetimes?

Issuance Policy

rugk August 21, 2015, 3:29pm 12

And when will it revoke the old certificate?

Topic		Replies	Views
Pros and cons of 90-day certificate lifetimes Issuance Policy	452	99417	October 23, 2018
Should LE allow for shorter and longer cert life times? Issuance Policy	31	4415	January 21, 2019
90 day expiration Feature Requests	32	741	March 27, 2025
[Poll] Do we need longer cert validity times? Issuance Policy	50	10040	May 10, 2016
Getting Bad Vibes	82	22661	January 17, 2017

Maximum (and minimum) certificate lifetimes?

Related topics