[Moderator’s note: If you would like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) this thread rather than posting a +1 comment, per Community Guidlines ]. Let’s Encrypt certificates currently have a ninety-day lifetime . Web standards do not require any minimum ce…

Well to be fair, you also seem to be making assumptions about their abilities unless you can provide some evidence or even just specific examples of their capabilities. Without any specifics, it’s hard to discuss the point you’ve raised. Of course if we assume that their capabilities are really tha…

Reminder: Discussions of how to go about backdooring a CA are offtopic for this thread, which is about concrete pros and cons of 90-day certificate lifetimes. @NOYB helpfully started a thread at Surveillance Advantages of Short Lifetime Certificates if you’d like to follow up there. Also as a remin…

BTW Congratulations on reaching public beta! :smiley: [image] jsha: There's no way as an end user to tell whether an unrecognized certificate is legitimate or not. Not true. There are a few (admittedly rare) cases where a user can trust a cert without having to rely on the CA trust model. e…

I’ve always been against pinning as it causes problems when you want to quickly change algorithm after a vulnerability has been detected and ultimately offers little benefit if you trust the trust model. We fell foul of this at work where we needed to change from sha1 certificates, but other teams u…

well I would say that TLSA Pininng works a lot better because they dont rely on long-term-storage of the browser. also since keys are used for the pinning a sole change f the algo wont hurt pinning, also you should always have some backup keys.

[image] yngndrw: I've always been against pinning as it causes problems when you want to quickly change algorithm after a vulnerability has been detected and ultimately offers little benefit if you trust the trust model. That's a very big if. Why would you trust the CA trust model? It's thor…

[image] piano: I'm told right now the idea is regenerate by default I really hope that's not true. If it is, I hope it's due to some practical barrier or other that I can help remove? I think you missed the "by default". :wink: You can always let the client ask to only renew the cert and …

I was going to generate one for my Firewall… until I notice the 90 days :frowning:

I like certs being used for 90 days, but I’d renew them 30 days before they expire. An expiry time of 120 days seems more reasonable. The automated renewal would be very good. Particularly if a multi-step process was set up for the manual version to allow people to script things for their internal …

Pros and cons of 90-day certificate lifetimes

Issuance Policy

jsha December 9, 2015, 11:51pm 116

I’ve forked off the pinning conversation over here: Pinning and SHA1 migration.

Topic		Replies	Views
Maximum (and minimum) certificate lifetimes? Issuance Policy	242	85783	November 30, 2015
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4485	December 22, 2018
[Poll] Do we need longer cert validity times? Issuance Policy	49	10102	April 10, 2016
90 day expiration Feature Requests	31	788	February 25, 2025
Getting Bad Vibes	80	22751	November 26, 2016

Pros and cons of 90-day certificate lifetimes

Related topics