74
Anyone using 6-day certs yet? (lemdro.id)
submitted 9 hours ago by to c/selfhosted@lemmy.world
24 comments fedilink hide all child comments
 

Since the beginning of this year, Let's Encrypt rolled out a new shortlived profile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).

Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?

As for me I've set up lego-acme with profile: "shortlived" on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 3 hours ago* (last edited 2 hours ago) (1 child)

At work, I used ssh-signed certificates for Linux server access - those certs are only valid for about 15 minutes.

The whole idea of shorter lifetime certificates is to address if a certificate is compromised. (Especially for client certificates which, iirc, Let's Encrypt no longer offers).

For a home lab? With no externally accessible services? Short-lived certs aren't really a big deal. Nobody is going to be hacking your homelab, stealing your private keys, poisoning your internal DNS, and pointing you to a different, malicious service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 hours ago

    If you're a developer for an important open source project, they might.

    Attacking the xz project wasn't done because the attacker cared about anything that the xz maintainer had. It was because he was trusted and the software he maintained had been given a fair bit of trust by certain maintainers and could be compromised and used as a vector into other systems that indirectly relied on that open-source project.

  • permalink
  • fedilink
  • source
  • parent