Earlier quoted context omitted.
Wait, what? How does the 3 month cert limit stem from a much more complicated problem? The 3 month cert limit is an arbitrary limit by Let's Encrypt, and has nothing to do with a more complicated problem. They could just as easily make it 6 months or a year, but instead they chose 3 months.
> How does the 3 month cert limit stem from a much more complicated problem? Broadly speaking Certificate Revocation is garbage. It doesn't work. So when a bad actor generates a bad certificate there's a legitimate chance that without Certificate Pinning, that Certificate will be accepted even if theoretically revoked. A three months max duration limits the potential liabilities to three months. Additionally three mo…
But what attack is that blunting?
1. A bad actor with access to the system will just regenerate another LE cert and carry on.
2. A bad actor who has injected a bad cert, but without system access, still has three months to conduct his fraud which is more than enough time to phish 90% of the user-base.
I'm not privy to the LE decision-making process but 90 days seems like the result of a bad compromise. Automated certs should be renewed on a very-high-frequency ( like hourly ) otherwise there's little benefit over the traditional model, and a lot of downsides such as breaking pinning.
90 days seems to have been chosen to be painful enough to push people into adopting auto-renewal but not frequent enough to overload LE's system, and thus not actually providing any security gains.