6-Day and IP Address Certificates Are Generally Available

Post by themafia » Sat, Jan 17, 2026, 4:34 AM UTC

hungryhobbit wrote: post #144

jsheard wrote: post #62

Earlier quoted context omitted.

For better or worse the push down to 47-day certificates is an industry-wide thing, in a few years no provider will issue certificates for longer than that. Nobody is being forced to use 6-day certs for domains though, when the time comes Let's Encrypt will default to 47 days just like everyone else.

And you don't think that years ago people would have said "of course you'll be able to keep your security cert for more than two months"? The people who innovate in security are failing to actually create new ways to verify things, so all that everyone else in the security industry can do to make things more secure is shorten the cert expiration. It's only logical that they'll keep doing it.

Post by sgjohnson » Sat, Jan 17, 2026, 5:04 AM UTC

kevincox wrote: post #50

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

The short-lived requirement seems pretty reasonable for IP certs as IP addresses are often rented and may bounce between users quickly. For example if you buy a VM on a cloud provider, as soon as you release that VM or IP it may be given to another customer. Now you have a valid certificate for that IP. 6 days actually seems like a long time for this situation!

Post by sgjohnson » Sat, Jan 17, 2026, 5:12 AM UTC

xg15 wrote: post #47

IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.

Post by Dylan16807 » Sat, Jan 17, 2026, 6:22 AM UTC

PunchyHamster wrote: post #130

halifaxbeard wrote: post #117

Earlier quoted context omitted.

> 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout There’s your answer. 6 days means on a long enough enough timeframe the load will end up evenly distributed across a week. 8 days would result in things getting hammered on specific days of the week.

> 6 days means on a long enough enough timeframe the load will end up evenly distributed across a week. people will put */5 in cron and result will be same, because that's obvious, easy and nice number.

Post by Dylan16807 » Sat, Jan 17, 2026, 6:55 AM UTC

PunchyHamster wrote: post #136

londons_explore wrote: post #74

Earlier quoted context omitted.

Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. Obviously you might still be victim #1 of such a scheme... But in general the CA's now aren't really trusted anymore - the real root of trust is the CT logs.

> Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale. Now if you're on latest browser you might be fine but any and every embedded device have their root CAs updated only on software update…