Revoking certain certificates on March 4 - Expected Timeframe

[tdelmas]

@dcs30

I honestly question therefore if this is a proportionate response to what appears to be a unexplioted issue with certificate issuance - namely to revoke trust on a contract that Let’s encrypt, has promised - that the certificate issued will be valid for 90 days.

It's not Let's Encrypt choice, it's an obligation: Revoking certain certificates on March 4 - #24 by jsha

@dcs30

I personally only received this email less than 24hrs before revocation (with it seems many others)

They have 5 days to revoke, and they needed the time to list the affected certificates.

@dcs30

I am worried that this change will do more damage, especially in big companies that miss your revocation notification emails and small independent companies that don’t have full-time DevOps engineers to move away from these far less secure days if we can’t even trust a certificate for the 90 days you sign it for.

It could, have and most certainly will happen again to other CA. What is needed is a mechanism to automate the early renewals. Maybe that could help in the futur: Check OCSP as part of determining if the certificate is due for renewal · Issue #1028 · certbot/certbot · GitHub