Selfhosted

Reducing the valid time will not solve the underlying problems they are trying to fix.

We're just gonna see more and more mass outages over time especially if this reduces to an uncomfortably short duration. Imagine what might happen if a mass crowdflare/microsoft/amazon/google outage that goes on perhaps a week or two? what if the CAs we use go down longer than the expiration period?

Sure, the current goal is to move everybody over to ACME but now that's yet another piece of software that has to be monitored, may have flaws or exploits, may not always run as expected... and has dozens of variations with dependencies and libraries that will have various levels of security of their own and potentially more vulnerabilities.

I don't have the solution, I just don't see this as fixing anything. What's the replacement?

And you still can't self certify.

It's cute the big players are so concerned with my little security of my little home server.

Or is there a bigger plan behind all this? Like pay more often, lock in to government controlled certs (already done I guess because they control DNS and you must have a "real" website name to get a free cert)?

I feel it's 50% security 50% bullshit.

Edit: thank you all I will dive down the CA certification rabbit hole now! Have worked in C++ & X509 on the client side so maybe I'll be able to figure it out.

Just skip to the point and make it 1 day

Just let me know so I can change my crontabs.

assuming "rest of the industry" in this context refers to ssl seller lobby.