Loooking forwards to Caddy supporting this
Looks like Matt's already on it: https://news.ycombinator.com/item?id=35294522
Reliability via Automated Renewal Information
41–45 of 45 posts
Re: Reliability via Automated Renewal Information
#42Earlier quoted context omitted.
The blog post mentions how this does help with the push for shorter cert lifetimes. > ARI can be used to set subscribers up for success in terms of ideal renewal times in the event that Let’s Encrypt offers even shorter-lived certificates in the future.
That's not the same. That's saying "We issued a 90-day cert but now want it to be less than that." What I'm saying is "Issue 7 day certs."
I hope we can use ARI to trigger renewals as-if we had short lived certs, along that pathway. From a scale-up perspective of running the CA, that’s very useful.
Much of Let’s Encrypts engineering time has been spent on revocation infrastructure, and I don’t like it. I’d much rather issue 2.5 day certs than 2.5 day OCSP responses we need to serve with high availability.
I’m hoping in the near future we see a CA/B ballot and and associated root program changes allowing us to not run OCSP infrastructure for short-lived certs.
That’s the kick needed to support short-lived certs. Of course Caddy is one of the best implementations of TLS and certificate handling and is already ready for that world, but many other systems are going to have a much worse time. That’s a big concern, and it’ll take everyone a while to switch to Caddy to fix their busted manual processes :)
(I’m an employee of Let’s Encrypt but these opinions are my own)
Re: Reliability via Automated Renewal Information
#43Earlier quoted context omitted.
The blog post mentions how this does help with the push for shorter cert lifetimes. > ARI can be used to set subscribers up for success in terms of ideal renewal times in the event that Let’s Encrypt offers even shorter-lived certificates in the future.
That's not the same. That's saying "We issued a 90-day cert but now want it to be less than that." What I'm saying is "Issue 7 day certs."
I don't see a standard 90 day certificate in the phrase "even shorter-lived certificates." If it was a 90 day certificate, it wouldn't be shorter-lived. It seems to me Let's Encrypt was referring to the possibility of exactly what you asked for, separately from revocation.
Re: Reliability via Automated Renewal Information
#44Earlier quoted context omitted.
That's not the same. That's saying "We issued a 90-day cert but now want it to be less than that." What I'm saying is "Issue 7 day certs."
I hope we can use ARI to trigger renewals as-if we had short lived certs, along that pathway. From a scale-up perspective of running the CA, that’s very useful. Much of Let’s Encrypts engineering time has been spent on revocation infrastructure, and I don’t like it. I’d much rather issue 2.5 day certs than 2.5 day OCSP responses we need to serve with high availability. I’m hoping in the near future we see a CA/B ball…
Thanks for the feedback. Congrats on deploying a new feature to production!
I'll see about adding ARI to Caddy in the hopes that it will accelerate the transition to shorter-lived certs.
Re: Reliability via Automated Renewal Information
#45Can anyone point to a working client implementation? It seems the API GET works but the POST to update the renewal isn't working for anyone as far as I can see.