[Moderator’s note: This thread is continued at Pros and cons of 90-day certificate lifetimes. If you’d like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) that thread.] What will the minimum (such as if I want to explicitly request a short lifetime) and maximum lifetime for certificates be?

There are other free certificates for one year, and payment by 15$, really someone will install one 90 days to save 15$? It makes no sense at all. The only purpose of these certificates is for testing.

Yes, Google is probably just using them for testing… They have been using 90 day certs for quite some time now, you can see it when looking at the certificate details for google.com or here: https://www.ssllabs.com/ssltest/analyze.html?d=www.google.com&s=74.125.239.137&hideResults=on

This tutorial by @renchap solved all of my “renewal” problems. It doesn’t even need to stop the server to pass the challenge. Honestly, renewing certs every 60 days might be great; it forces us to automate everything and eliminate any human error that could screw everything. (that, of course, if the automation process is done correctly)

Create a certificate system requires a lot of responsibility. If certificates of more than 90 days are unsafe, should not exist in any other case, if wildcard certificates are unsafe should not exist at all. There is not a security problem, is a problem of responsibility. They want to do something that requires a lot of responsibility not assume at all. Security is not a reason, it’s an excuse.

That’s really a good solution, a second root. I’m actually using that in my integration as well. :+1:

I presume you in a way shared an opinion with this extremely vocal “90 days certs are bad” minority. And basically said that Google engineers are out of their minds… And if you (and by you I mean everyone in the aforementioned minority group) don’t like LE practices, you are very much welcome to use services of any other CA in the field. Freedom of choice, right? I though it’s very much clear at this point, that longer certificates from LE are a no go, and these complaints are not helping anyone, they’re just adding to the universe’s entropy.

This discussion is the most active thread in this forum and the “minority” (as some “fanboys” call those who are against this policy) is the one that has voiced the real-world concerns of the 90-days limit. I have yet to a see a compelling argument on why the limit is in place, other than, “Google does it, so we must as well”, or “it’s good for you, trust us”. This is the most ridiculous argument which demonstrates the lack of real-world applications this project will have. Unless of-course Let’s encrypt is aimed at Google-sized businesses, which makes perfect sense. Anyway as an IIS server admin, who is snubbed in the n-th degree by this whole project, I’m dissapointed by the lack of understanding on why people need a choice on the certificate validity length. The single minded “automation” only, no manual process is also both annoying and dangerous. I just wish Let’s encrypt had informed us fully on their schemes before getting our hopes up. Anyway, I wish all the best to any poor soul wishing to commit to this project…

[image] Nekit: And basically said that Google engineers are out of their minds [image] ikarydis: I have yet to a see a compelling argument on why the limit is in place, other than, "Google does it, so we must as well" It's probably worth noting that Google wrote a majority of their software - they're doing it because they can ensure it works. That doesn't apply to most of us.

I, and most of the dissenters, do not think 90 day cert lifetimes are necessarily bad. But our issue is with only issuing 90 day lifetime certs when there is clearly issues that make them impractical for many environments and applications. If there where some significant technical limitation that prevented or made issuing 1 year lifetime certificates impractical that would be different. But the Let’s Encrypt policy is being based on misguided control freak and behavioral driving philosophy. Beginning to feel like a government program. Might fit in well, philosophically, in China and NK.

Maximum (and minimum) certificate lifetimes?

Issuance Policy

eva2000 November 10, 2015, 9:18pm 139

yup @renchap guide at Howto: easy cert generation and renewal with nginx

Topic		Replies	Views
Pros and cons of 90-day certificate lifetimes Issuance Policy	443	102339	February 6, 2017
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4769	December 22, 2018
90 day expiration Feature Requests	31	1101	February 25, 2025
[Poll] Do we need longer cert validity times? Issuance Policy	49	10433	April 10, 2016
Getting Bad Vibes Uncategorized	80	23272	November 26, 2016

Maximum (and minimum) certificate lifetimes?

Related topics