lobsters score: 1 · tags: devops
I think the specific choice of 64 days is quite clever. Most ACME clients out there that don’t yet use ARI are set up to renew after 60 days, which means anybody still running these will now still not run into expiry but will get a bunch of “your certs are about to expire” warnings from Let’s Encrypt and also potentially their own monitoring, so they can update their automation accordingly. I think this choice demonstrates quite a bit of forethought and care for their users, kudos!
score 1 · canonical
Nitpick : LE stopped sending such notices https://letsencrypt.org/2025/01/22/ending-expiration-emails
score 1 · canonical
I really ought to take the time to write up a simple program that pokes ACME and my DNS server to make a new certificate, then learn enough systemd to make it run weekly.
score 1 · canonical
Check out https://github.com/dehydrated-io/dehydrated - its a shell script you can just drop on a server and go
score 2 · canonical
Ugh. When will the madness end! Makes me almost wish for the days of paying for a cert…
score 1 · canonical
You want to replace a procedure that not only supports but highly encourages (basically forces) automation of a repetitive task with a process that is needlessly manual and costs money?
score 1 · canonical
I mean you can still go and pay for a cert, Let’s Encrypt is far from the only CA.
But really, what is the madness here? Who cares if it goes down to 64 days, or less for that matter? My ACME clients certainly don’t. Maybe anybody ingesting CT logs will notice the somewhat higher bandwidth requirements?
score 1 · canonical
Make sure your ACME client supports ARI so that it automatically adjusts its renewal schedule and gracefully handles revocation and early reissue. Even 45 day certs will be renewed weeks in advance so a CA outage should not be a big deal.
score 1 · canonical
It’s not a Let’s Encrypt limit https://cabforum.org/working-groups/server/baseline-requirements/requirements/#632-certificate-operational-periods-and-key-pair-usage-periods
score 1 · canonical
When will the madness end!
February 2028 when lifetimes are reduced to 45 days: https://lobste.rs/s/r2bamx/decreasing_certificate_lifetimes_45
score 1 · canonical