119
Anyone using 6-day certs yet? (lemdro.id)
submitted 1 day ago by to c/selfhosted@lemmy.world
48 comments fedilink hide all child comments
 

Since the beginning of this year, Let's Encrypt rolled out a new shortlived profile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).

Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?

As for me I've set up lego-acme with profile: "shortlived" on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.

you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 19 hours ago (1 child)

@Ooops I do not understand what you mean with "they are failing to advertise this". Letsencrypt has announced in in their blog:
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs
https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued
The profiles are documented:
https://letsencrypt.org/docs/profiles/
It is your deciscion what profile to use. If you use the shortlived profile and your key is compromised, you benefit from the short lifetime. This benefit you have regardless of the availability of the 90 day certs.

https://letsencrypt.org/2025/01/16/6-day-and-ip-certs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 8 hours ago

    If you use the shortlived profile and your key is compromised, you benefit from the short lifetime.

    Maybe I'm just too stupid to understand how those certificates work.

    But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?

    Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.

  • permalink
  • fedilink
  • source
  • parent