How are IP certs any good in the days of cloud? I presume they are used in instances where it’s tied to a “well known” ip?
Six day and IP address certificate options in 2025
91–100 of 166 posts
Re: Six day and IP address certificate options in 2025
#92This feels like a disaster waiting to happen -- like what happens if (when?) Let's Encrypt suffers a significant outage and sites can't refresh certificates? Do we just tolerate a significant portion of the Internet being down or broken due to expired certificates? And for what tradeoff? A very small amount of extra security? Is this because certificate revocation is a harder problem to solve / implement at Internet…
Fortunately, most ACME clients, including my own, support other CAs as fallbacks. (Caddy's ACME stack falls back to ZeroSSL by default, automatically.) That, and extended week-long outages are extremely unlikely.
Plenty of clients don't have that option. E.g.: Synology NAS, Mikrotik routers.
Re: Six day and IP address certificate options in 2025
#93Earlier quoted context omitted.
> That, and extended week-long outages are extremely unlikely. You only need the outage to last for the window of [begin renewal attempts, expiration], not the entire 6d lifetime. For example, with the 90d certs, I think cert-manager defaults to renewal at 30d out. Let's assume the same grace, of ~33% of the total life, for the 6d certs: that means renew at 2d out. So if an outage persisted for 2d, those certs would…
True, but it doesn't matter since competent clients should be falling back to other CAs anyway.
Sounds likes a surefire way to DDOS the next CA in line (and then all the others), since supposedly they wouldn't be prepared for that kind of traffic since LetsEncrypt is currently the default choice almost everywhere.
Re: Six day and IP address certificate options in 2025
#94How are IP certs any good in the days of cloud? I presume they are used in instances where it’s tied to a “well known” ip?
It's often very difficult to get domain names in large orgs, but very easy to get public IPs. An IP can be as easy as a couple of buttons to get a static IP and assign it to a cloud LB in AWS or Google Cloud. Domain Names usually require choosing a domain name (without picking a name that reveals internal project details), then convincing someone with budget to buy the domain, then someone has to manage the domain name forevermore. For quick demos, or simple environments, it'd easier to just get a static IP and use that.
Re: Six day and IP address certificate options in 2025
#95This will get interesting for many CT transparency monitors which for many are already seeing scalability issues. I am operating https://www.merklemap.com/ and the current scale is already impressive.
[deleted]
Re: Six day and IP address certificate options in 2025
#96What are reasons to use a certificate for an IP? Why wouldn't you use a name? Someone already mentioned that it's needed for Discovery of Designated Resolvers (DDR) for DNS-over-HTTPS. Anything else?
Names cost cash; maybe you don't need/want one.
Re: Six day and IP address certificate options in 2025
#97Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.
To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…
I'm used to certs in Kubernetes, so even 6 days is long-lived. 20 minutes is more like it.
Re: Six day and IP address certificate options in 2025
#98Earlier quoted context omitted.
To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…
I'm used to certs in Kubernetes, so even 6 days is long-lived. 20 minutes is more like it.
Doesn't that run into their rate limits if you generate a certificate every few minutes all the time? Or at least might be a burden, even if it didn't hit an absolute limit. (I'm assuming you're not the only person in the world doing this, so I mostly mean the collective effect this sort of usage pattern has)
Re: Six day and IP address certificate options in 2025
#99Earlier quoted context omitted.
I'm used to certs in Kubernetes, so even 6 days is long-lived. 20 minutes is more like it.
Doesn't that run into their rate limits if you generate a certificate every few minutes all the time? Or at least might be a burden, even if it didn't hit an absolute limit. (I'm assuming you're not the only person in the world doing this, so I mostly mean the collective effect this sort of usage pattern has)
Sorry, I should have clarified. You can't do certificates that fast on Let's Encrypt no. I meant running a custom CA inside/alongside Kubernetes, and using that to issue 20-minute validity certs to pods.
Re: Six day and IP address certificate options in 2025
#100I don't disagree with anything they say here: https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/#short... But... How often do these types of compromises happen? I can't say I've ever seen or heard of it happening.
Hmmm. This solution still leaves quite a few days a compromised certificate can be used(!).. that's significant.. but I guess it's better than nothing?