Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six day and IP address certificate options in 2025

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 166 posts

Re: Six day and IP address certificate options in 2025

#111

Post by throw0101a »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

> To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up.

I've been running an LE client (official one, dehydrated, others) on various system for ~8 years, and the one time I had an issue with renewing was when (AIUI) the LE folks changed CDNs and so their responses were (slightly) different and dehydrated needed to be tweaked:

* https://community.letsencrypt.org/t/jws-has-no-anti-replay-n...

* https://github.com/dehydrated-io/dehydrated/commit/e4e712c03...

Other than that, never had an issue.

Re: Six day and IP address certificate options in 2025

#112

Post by petee »

jabart wrote: post #28

Six days? I can't even set the cron job to weekly. Maybe that is the point of this though from being on call I really hate thing restarting every day. Caddy, Nginx, HAProxy, and IIS all seem to handle certs without a full restart. MS SQL Server, nope.

While it wouldn't help currently, I'm sure in time accomodations will be made - for example the acme-client on openbsd will only renew if <30 days from expiration, so it's crond weekly. A client will just need to support custom times, so call it daily and it will renew when 1 or 2 days out to be safe

Re: Six day and IP address certificate options in 2025

#113

Post by chrismorgan »

> The dns-01 challenge type will not be available because the DNS is not involved in validating IP addresses. Additionally, there is no mechanism to check CAA records for IP addresses.

Is in-addr.arpa. not usable for these purposes? Given how you can do PTR records to map IP address to domain name, I had just assumed it would be at least theoretically usable for more, even if few or no hosts exposed it so at present.

Re: Six day and IP address certificate options in 2025

#114

Post by baby_souffle »

chrismorgan wrote: post #113

> The dns-01 challenge type will not be available because the DNS is not involved in validating IP addresses. Additionally, there is no mechanism to check CAA records for IP addresses. Is in-addr.arpa. not usable for these purposes? Given how you can do PTR records to map IP address to domain name, I had just assumed it would be at least theoretically usable for more, even if few or no hosts exposed it so at present.

That just proves you have a way to manipulate DNS.

Doesn’t prove you own the thing the IP routes to.

Re: Six day and IP address certificate options in 2025

#115

Post by mixdup »

baby_souffle wrote: post #114
chrismorgan wrote: post #113

> The dns-01 challenge type will not be available because the DNS is not involved in validating IP addresses. Additionally, there is no mechanism to check CAA records for IP addresses. Is in-addr.arpa. not usable for these purposes? Given how you can do PTR records to map IP address to domain name, I had just assumed it would be at least theoretically usable for more, even if few or no hosts exposed it so at present.

That just proves you have a way to manipulate DNS. Doesn’t prove you own the thing the IP routes to.

I mean that applies to DNS authentication for non-IP certificates, too

Re: Six day and IP address certificate options in 2025

#116

Post by Arnavion »

ray_v wrote: post #60

This feels like a disaster waiting to happen -- like what happens if (when?) Let's Encrypt suffers a significant outage and sites can't refresh certificates? Do we just tolerate a significant portion of the Internet being down or broken due to expired certificates? And for what tradeoff? A very small amount of extra security? Is this because certificate revocation is a harder problem to solve / implement at Internet…

I agree. Anecdotally, the last time LE had an outage that prevented my cert from renewing, it took about ~4.5 days from when I reported the issue to them to when they started looking and provided a workaround. Since this was a 90-day cert it still had 30 days left on it, so I wasn't worried. If it had been a 6-day cert and only had 2 days left on it, I would've had to go to red alert and switch to another CA ASAP.

https://community.letsencrypt.org/t/post-to-new-order-url-fa...

If they do start providing 6-day certs I hope their turnaround on issue reports is faster than that (and ideally have something better for reporting issues than a community forum where you have to suffer clueless morons spamming your thread).

Re: Six day and IP address certificate options in 2025

#117

Post by Cerium »

ncruces wrote: post #79
zzyzxd wrote: post #75

Earlier quoted context omitted.

I am not saying 6 days is long enough, but if your automation always wait until the last minute to renew certs, you may have more issues to worry about than the CA's availability. If I am going to use a cert with 6 days lifetime I will be renewing it at least once a day.

Yeah, that conflicts with their rate limits, which I hope they'll revise under this scheme. https://letsencrypt.org/docs/rate-limits/ For the “exact same set of hostnames” (aka. renewals) the rate limit is 5 certificates every 7 days. So you could do it every other day, if you can make sure there's only one client doing it. And they're very clear this is a global limit: creating multiple accounts doesn't subvert it.…

If you have multiple hosts the set should not be the same, no? From the linked page the comparison is a set comparison: one host at hosta.example.com and one host at hostb.example.com each with their own cert bot won't conflict.

Re: Six day and IP address certificate options in 2025

#118

Post by bruce511 »

telotortium wrote: post #87
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Speaking of the topic of automation, does anyone know of a domain registry that is suitable for issuing Let's Encrypt certificates for a machine behind a firewall (which requires using the DNS challenge)? I currently use Namecheap, but they started requiring you to manually whitelist the client IP address to use their API, which is annoying when your residential ISP changes your IP address. Edit: seems like using Clo…

I use DNSimple.com - it's working well, and has a stable API that can let you do anything.

Re: Six day and IP address certificate options in 2025

#119

Post by coffee-- »

birdman3131 wrote: post #88
telotortium wrote: post #87

Earlier quoted context omitted.

Speaking of the topic of automation, does anyone know of a domain registry that is suitable for issuing Let's Encrypt certificates for a machine behind a firewall (which requires using the DNS challenge)? I currently use Namecheap, but they started requiring you to manually whitelist the client IP address to use their API, which is annoying when your residential ISP changes your IP address. Edit: seems like using Clo…

Digital ocean can be used as name servers without paying and they have an API. No clue how compatible.

I use Digital Ocean via Caddy and acme.sh with no problems

Re: Six day and IP address certificate options in 2025

#120

Post by theoreticalmal »

outworlder wrote: post #81
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

> To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient I's only inconvenient because it isn't properly automated. That's by design. When this can be a acme.sh script cronjob, there isn't much of an excuse. Even my Raspberry Pi dedicated to my 3D printer is happily renewing certificates. At least with this thing breaking every 90 days you have it fresh on your mind. One…

What does your 3D printer Pi serve such that it needs a cert? Do you have ports 80 and 443 open and forwarded to it?
Post reply on HN