this post was submitted on 02 Dec 2025
460 points (98.9% liked)

Selfhosted

60451 readers
637 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
460
Decreasing Certificate Lifetimes to 45 Days (letsencrypt.org)
submitted 7 months ago by artiman@piefed.social to c/selfhosted@lemmy.world
196 comments fedilink hide all child comments
 

Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028.
This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow. All publicly-trusted Certificate Authorities like Let’s Encrypt will be making similar changes. Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient.

you are viewing a single comment's thread
view the rest of the comments
[–] Prove_your_argument@piefed.social 18 points 7 months ago (1 children)

Reducing the valid time will not solve the underlying problems they are trying to fix.

We're just gonna see more and more mass outages over time especially if this reduces to an uncomfortably short duration. Imagine what might happen if a mass crowdflare/microsoft/amazon/google outage that goes on perhaps a week or two? what if the CAs we use go down longer than the expiration period?

Sure, the current goal is to move everybody over to ACME but now that's yet another piece of software that has to be monitored, may have flaws or exploits, may not always run as expected... and has dozens of variations with dependencies and libraries that will have various levels of security of their own and potentially more vulnerabilities.

I don't have the solution, I just don't see this as fixing anything. What's the replacement?

[–] fistac0rpse@fedia.io 14 points 7 months ago (2 children)

clearly the most secure option is to have certificates that are only valid for 30 seconds at a time

[–] fxdave@lemmy.ml 7 points 7 months ago (1 children)

Let's be extra safe. New cert per every request

[–] RheumatoidArthritis@mander.xyz 4 points 7 months ago

Ephemeral diffie-hellman is exactly that, it's part of TLS since I think 1.2

[–] nialv7@lemmy.world 1 points 7 months ago* (last edited 7 months ago)

Well it should be as short as possible while still being practical. LE doesn't have infinite server compute, renewal also takes some amount of time, plus if they make the validity too short people might stop using them (pretty evident judging from sentiment here) and move to other CAs and make what they do pointless.

45 days are still plenty of time yet people are already complaining. Does make me worry.