Let's Encrypt Announces New-Certificate-Every-6-Days Offering
Let's Encrypt Announces New-Certificate-Every-6-Days Offering
This letter was originally published in our 2024 Annual Report. The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before...
I understand their reasoning behind this, but I am not sure, this is such a good idea. Imagine Letsencrypt having technical issues or getting DDoS'd. If the certificates are valid for 90 days and are typically renewed well in advance, no real problem arises, but with only 6 days in total, you really can't renew them all that much in advance, so this risk of lots of sites having expired certificates in such a situation appears quite large to me.
That's true, but it would also have to be a serious attack for LE to be down for 3 entire days. There are multiple providers for automated certs, so you could potentially just switch if needed.
The attack would only need to last for a day or two, and then everyone requesting updated certs when it stops could push enough people outside the 6-day window to cause problems. 6 days is probably long enough to not be a huge issue, but it's getting close to problematic. Maybe change to 15 days, which should avoid the whole issue (people could update once/week and still have a spare week and a day to catch issues).
I volunteer to help with IT at a makerspace, and I hesitate to go for 6 day expiration times. As volunteers, we can't always fix problems in a timely way like paid IT staff could. We try to automate the hell out of everything, but certs have gone a day or two without getting updated before.
When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn't the biggest issue with server certificates.
The sites I have most frequently have had to add expired certificates to use are US government websites. Particularly those affiliated with the military branches. It’s sad.
Yes X.509 is broken. If you're a developer and not pinning certs, you're doing it wrong.
What is the use case or benefit for the server admin?
as a server admin I wouldn't want to keep renewing my cert.
can anyone help to explain?
Lets Encrypt certs tend to be renewed by a cronjob, anyway. The advantage is that if someone gets your cert without your knowledge, they have, at most, six days to make use of it.
It's kind of in line with their plan to get rid of OCSP: short certificate lifetimes keep CRLs short, so I get where they're coming from (I think).
90 days of validity, which was once a short lifetime. Currently, Google is planning to enforce this as the maximum validity duration in their browser, and I'm sure Mozilla will follow, but it wouldn't matter if they didn't because no provider can afford to not support chromium based browsers.
I was expecting that they reduce the maximum situation to e.g. 30 days, but I guess they want to make the stricter rules optional first to make sure there are no issues.
Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).
I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.
You can use DNS challenge to renew your certificates without opening ports! Have a look at acme.sh for automation.
Digicert, Sectigo, Globalsign: hold my beer, 1 day certificate, even better: on the fly certificate per client 😂
I wonder how short this could conceivably go…
Increase how often the drones call the mothership, excellent.
Don’t certs just create an ephemeral key pair that disappears after the session anyhow? What does cert validity period have to do with “This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.”
I mean, it’s LE so I’m sure they know what their talking about. But…?
compromising a keypair is a huge win. lets you impersonate the domain. shorter validation periods = smaller windows of compromised situations.
basically the smaller you make the window the less manual intervention and the less complicated infrastructure gets. currently TLS systems need a way to invalidate certificates. get them down to a day and suddenly that need just disappears. vastly simplifying the code and the system. 6 days is a huge improvement over 90 days.
I'm far from an expert on PKI, but isn't the keypair used for the cert used for key exchange? Then in theory, if that key was compromised, it could allow an adversary to be able to capture and decrypt full sessions.
The key pair you're thinking of is just a singular key for a block cipher. That key needs to be generated/transmitted in a secure manner. Meaning that its security is dependent on the cert. The expiration time of that cert is what they're aiming at.
Since I set up a https website (lemmy) and had to deal with the hassle of certificates, I do wonder why you need another entity to churn out what's basically a RSA key pair?
Is it this you must trust the government again or is there some better reasons for it?
It's to make sure you're actually reaching your intended endpoint. If I'm visiting a site for the first time, how do I know I actually have THEIR certificate? If it's self generated, anybody could sign a certificate claiming to be anybody else. The current system is to use authority figures who validate certificates are owned by the site you're trying to visit. This means you have a secure connection AND know you're interacting with the correct site.