[Moderator’s note: This thread is continued at Pros and cons of 90-day certificate lifetimes . If you’d like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) that thread.] What will the minimum (such as if I want to explicitly request a short lifetime) and maximum li…

Very nice idea. The only bad thing is that occasional visitors (who only visit the site after 90 days) do not benefit from the security mechanism HPKP. But possibly you do not have many of such visitors, so that this does not matter. Just keep in mind that the certificate lifetime might be reduced…

It’s not practical to do. The API (although I’d hesitate to use the term. The mechanism is extremely simple) is accompanied by pages users may wish to view in browser. I could potentially not check the cert validity when connecting and use a separate signing mechanism, but this would increase comple…

Well, I just got into the beta, and I’m just absolutely appalled at this 90-day policy. This doesn’t achieve any of your stated goals, and in fact actively works against them. Early in the thread, you say that manual mode is required by customers, but then you very explicitly try to make manual mo…

if you have an own software then you could just implement your Own CA pin its root and do the certs yourself.

[image] rugk: The only bad thing is that occasional visitors (who only visit the site after 90 days) do not benefit from the security mechanism HPKP HPKP works off the SPKI (public key hash), not the certificate. That's why you can generate the hash from the private key file before you even g…

[image] jcjones: I'm told right now the idea is regenerate by default -- but there should be a config parameter to change to re-using the existing CSR/private key. Clearly that's what you and I want to turn on. Having a backup key is still extremely critical for compromise recovery, so it's sti…

I'd suggest moving this HPKP discussion to another thread (or continuing it there) as it's quite unrelated to the lifetime of the certificates. [image] HTTP Public Key Pinning (HPKP) Server C…

Just to throw in another opinion, as I just got into the beta: I use WebFaction which allows for free certificate usage and installation. However, to get a certificate on my host, I have to generate the cert and key, place it in my home dir on the host, and submit a support ticket to have it instal…

Hi! First off all, thanks for doing this - it’s a very good cause. In my experience, it is 100% true that certificate expiration errors are a serious problem, and occur way more frequently than they should. This is precisely why I am frustrated by the choice of 90 days for the certificate lifetime.…

Long vacations are a valid point I think. Maybe there will be another ACME CA that pops up that will offer longer certificate lifetimes. It just wouldn’t push automation as much and there wouldn’t be as much pressure for it to be reliable automation … which is important. In the future, with multip…

Maximum (and minimum) certificate lifetimes?

Issuance Policy

eva2000 October 29, 2015, 9:59pm 94

that's indeed best

what config paramter is for re-using existing CSR or existing private key ?

HTTP Public Key Pinning (HPKP)

Topic		Replies	Views
Pros and cons of 90-day certificate lifetimes Issuance Policy	443	100156	February 6, 2017
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4607	December 22, 2018
90 day expiration Feature Requests	31	869	February 25, 2025
[Poll] Do we need longer cert validity times? Issuance Policy	49	10172	April 10, 2016
Getting Bad Vibes	80	22795	November 26, 2016

Maximum (and minimum) certificate lifetimes?

Related topics