[Moderator’s note: If you would like to express your support for longer certificate lifetimes, please ‘like’ (:heart:) this thread rather than posting a +1 comment, per Community Guidlines ]. Let’s Encrypt certificates currently have a ninety-day lifetime . Web standards do not require any minimum ce…

[image] jvanasco: I'm fine with a 90 day - or even 10 day - expiration on the certificate. What I'm not fine with, is that there is no official policy on how long I can reliably depend on renewals targeting currently compatible browsers and devices. This currently requires a leap-of-faith. W…

I'm not talking about breaking ACME or code or developer tools, I'm talking about breaking penetration. So I'll try this again... The intermediate cross-signing certificate could change. It's incredibly unlikely to change, but it could change. It is currently cross-signed by a specific IdenTrust…

[image] jvanasco: Future "business" issues could require working with another vendor to cross-sign, or staying with IdenTrust but being cross-signed by another one of their roots. That potential other certificate would not necessarily have the same penetration for browser/device/operating syste…

[image] jvanasco: This could, I stress, be handled quite simply by a bulletpoint in the policy that states something like "if we begin signing with new keys for any reason, we will strive to use options that have equal distribution/compatibility." Perhaps also promise trying to give 6mos or 1yr…

[image] pfg: Short of IdenTrust's (offline) root key being compromised (i.e. the "security flaw/short-term fix" case), I don't see a switch like that happening without significant advance notice I don't either. But there's a difference between "what an established community member feels an of…

Side mention: I think that “Reply as linked topic” button is not visible to new users .

This thread, again, got far too long to read it completely. As far as I see there never was any response of the responsible people, right? There may be many advantages of this “auto renew” thing but even if they exist, this mechanism shouldn’t be forced. There are many users that can’t use this a…

[image] M-Reimer: There are many users that can't use this auto renew process (as they are not allowed to install such services in shared hosting, for example) This situation shouldn't exist, cPanel/WHM now support LE with the AutoSSL feature. The onus is on hosting providers to keep up with …

I don’t think so. At least for me HTTPS is not a that big priority. I could use it if it would be easy to use, but I won’t change my hoster just for LE. The idea behind LE is great (free certificates for everyone) but at least for me it is a bad decision to force people into the automatic certificat…

[image] M-Reimer: This thread, again, got far too long to read it completely. Obviously, or you'd have seen that the issue you raised has already been discussed ad nauseum. Automation is central to Let's Encrypt's model. If you are unable or (more likely) unwilling to use an automated solut…

Pros and cons of 90-day certificate lifetimes

Issuance Policy

Topic		Replies	Views
Maximum (and minimum) certificate lifetimes? Issuance Policy	242	85722	November 30, 2015
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4477	December 22, 2018
[Poll] Do we need longer cert validity times? Issuance Policy	49	10048	April 10, 2016
90 day expiration Feature Requests	31	764	February 25, 2025
Getting Bad Vibes	80	22750	November 26, 2016

Pros and cons of 90-day certificate lifetimes

Related topics