Six day and IP address certificate options in 2025

Post by o11c » Thu, Jan 16, 2025, 10:38 PM UTC

Eikon wrote: post #21

This will get interesting for many CT transparency monitors which for many are already seeing scalability issues. I am operating https://www.merklemap.com/ and the current scale is already impressive.

Post by MaKey » Thu, Jan 16, 2025, 10:42 PM UTC

ryandrake wrote: post #37

rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Post by mholt » Thu, Jan 16, 2025, 10:56 PM UTC

deathanatos wrote: post #70

mholt wrote: post #68

Earlier quoted context omitted.

Fortunately, most ACME clients, including my own, support other CAs as fallbacks. (Caddy's ACME stack falls back to ZeroSSL by default, automatically.) That, and extended week-long outages are extremely unlikely.

> That, and extended week-long outages are extremely unlikely. You only need the outage to last for the window of [begin renewal attempts, expiration], not the entire 6d lifetime. For example, with the 90d certs, I think cert-manager defaults to renewal at 30d out. Let's assume the same grace, of ~33% of the total life, for the 6d certs: that means renew at 2d out. So if an outage persisted for 2d, those certs would…

Post by birdman3131 » Thu, Jan 16, 2025, 11:04 PM UTC

telotortium wrote: post #87

ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Speaking of the topic of automation, does anyone know of a domain registry that is suitable for issuing Let's Encrypt certificates for a machine behind a firewall (which requires using the DNS challenge)? I currently use Namecheap, but they started requiring you to manually whitelist the client IP address to use their API, which is annoying when your residential ISP changes your IP address. Edit: seems like using Clo…

Post by jchw » Thu, Jan 16, 2025, 11:05 PM UTC

telotortium wrote: post #87

ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

Speaking of the topic of automation, does anyone know of a domain registry that is suitable for issuing Let's Encrypt certificates for a machine behind a firewall (which requires using the DNS challenge)? I currently use Namecheap, but they started requiring you to manually whitelist the client IP address to use their API, which is annoying when your residential ISP changes your IP address. Edit: seems like using Clo…