104
Anyone using 6-day certs yet? (lemdro.id)
submitted 23 hours ago by to c/selfhosted@lemmy.world
43 comments fedilink hide all child comments
 

Since the beginning of this year, Let's Encrypt rolled out a new shortlived profile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).

Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?

As for me I've set up lego-acme with profile: "shortlived" on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.

you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 10 hours ago (1 child)

@Ooops @stratself Certbot renews a certificate when the remaining lifetime is lower than 30 %. If you change the profile from tlsserver (90 days) to shortlived (6 days), you do not need to adjust the renewal interval manually, because it is relative to the cert livetime.
I think it is not Letsencrypt's part to document how to use the different profiles with certbot. It should be explained in the documentation of the ACME client (certbot and others).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 4 hours ago

    I know that I could easily change my config. My point is that a) they are failing to advertise this and b) I don't see any reason to do it. I understand the arguments about security benefits of shorter certificates on their side and iirc they are already planning to change it from 3 months to 1.5 months in the future. But in what scenario do I benefit from a short-term certificate as long as the regular ones are still available anyway?

  • permalink
  • fedilink
  • source
  • parent