Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six day and IP address certificate options in 2025

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 166 posts

Re: Six day and IP address certificate options in 2025

#71

Post by Eikon »

mholt wrote: post #69
Eikon wrote: post #21

This will get interesting for many CT transparency monitors which for many are already seeing scalability issues. I am operating https://www.merklemap.com/ and the current scale is already impressive.

I don't know much about CT requirements, but can't they prune data out of their logs after some time? Since the certs only last 6 days, the growth of the logs can be capped at some point right? If not now, provisions for such operations could surely be implemented, I imagine. PS. Neat site!

> I don't know much about CT requirements, but can't they prune data out of their logs after some time? Since the certs only last 6 days, the growth of the logs can be capped at some point right?

That's what happens - logs are "expired" after a few years. But if you want to have an exhaustive monitor, you probably don't want to discard the records of expired certificates.

> PS. Neat site!

Thank you!

Re: Six day and IP address certificate options in 2025

#72

Post by Rodeoclash »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Is it possible for you to run Caddy as a reverse proxy in front of your services? I've done this in the past and it really is set and forget when it's configured correctly.

Re: Six day and IP address certificate options in 2025

#75

Post by zzyzxd »

pilif wrote: post #66
arianvanp wrote: post #65

Earlier quoted context omitted.

A 7 day outage seems rather unlikely no?

In average half of the certs would expire in half of the time. A 3.5 days sustained DDoS attack would cause half of the sites using a 6 day certificate to be offline.

I am not saying 6 days is long enough, but if your automation always wait until the last minute to renew certs, you may have more issues to worry about than the CA's availability. If I am going to use a cert with 6 days lifetime I will be renewing it at least once a day.

Re: Six day and IP address certificate options in 2025

#77

Post by ghxst »

Rodeoclash wrote: post #72
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Is it possible for you to run Caddy as a reverse proxy in front of your services? I've done this in the past and it really is set and forget when it's configured correctly.

Heard positive things about Caddy before, do you know if it works with ip adresses as well?

Re: Six day and IP address certificate options in 2025

#78

Post by DonHopkins »

prdonahue wrote: post #59
captn3m0 wrote: post #6

I remember being surprised when Cloudflare launched https://1.1.1.1 with a valid cert and I immediately wanted one, but couldn’t find an easy way to get one. I am gonna try to run a DoH resolver on this and see how it goes.

This was a fun conversation. I remember calling Clint and Jeremy at DigiCert and asking: "hey we have this cool IP address—what are the odds you guys can issue a certificate for it?" I'm not sure if they had to dust off some code or process to do it, but they got it done really quickly once the demonstration of control was handled.

The coolest easiest to remember ip address I ever used was mimsy.cs.umd.edu: 128.8.128.8

Re: Six day and IP address certificate options in 2025

#79

Post by ncruces »

zzyzxd wrote: post #75
pilif wrote: post #66

Earlier quoted context omitted.

In average half of the certs would expire in half of the time. A 3.5 days sustained DDoS attack would cause half of the sites using a 6 day certificate to be offline.

I am not saying 6 days is long enough, but if your automation always wait until the last minute to renew certs, you may have more issues to worry about than the CA's availability. If I am going to use a cert with 6 days lifetime I will be renewing it at least once a day.

Yeah, that conflicts with their rate limits, which I hope they'll revise under this scheme.

https://letsencrypt.org/docs/rate-limits/

For the “exact same set of hostnames” (aka. renewals) the rate limit is 5 certificates every 7 days.

So you could do it every other day, if you can make sure there's only one client doing it.

And they're very clear this is a global limit: creating multiple accounts doesn't subvert it.

So you'll need to manage this centrally, if you have multiple hosts sharing a hostname.

Re: Six day and IP address certificate options in 2025

#80

Post by DonHopkins »

Retr0id wrote: post #53
mholt wrote: post #43

Earlier quoted context omitted.

ZeroSSL I think will get you IP certificates with their cheapest plan. (Disclaimer: I work on Caddy, which is a ZeroSSL project; but I do so independently.)

"cheapest" being the free plan, or the cheapest non-free plan?

Careful, sometimes free plans are more expensive than money! ;)
Post reply on HN