Six day and IP address certificate options in 2025
letsencrypt.org
Six day and IP address certificate options in 2025
1–10 of 166 posts
Re: Six day and IP address certificate options in 2025
#2> Our six-day certificates will not include OCSP or CRL URLs.
If someone else did this, Mozilla would be threatening to remove them from their trusted roots.
IP address certs sound like a security nightmare that could be subverted by BGP hijacking. Which is why most CAs don't issue them. Does accessing the ACME challenge from multiple endpoints adequately prevent this type of attack?
Re: Six day and IP address certificate options in 2025
#3I'm very interested in trying this. acme.sh is planning to support certificate profiles, so hopefully that'll be ready when LE's short-lived certificates become available.
(Or I'll switch to a different ACME client I suppose)
Re: Six day and IP address certificate options in 2025
#4> Our six-day certificates will not include OCSP or CRL URLs. If someone else did this, Mozilla would be threatening to remove them from their trusted roots. IP address certs sound like a security nightmare that could be subverted by BGP hijacking. Which is why most CAs don't issue them. Does accessing the ACME challenge from multiple endpoints adequately prevent this type of attack?
Not true. CA's are explicitly allowed to omit CRL support for certificates with a lifetime <= 10 days.
Re: Six day and IP address certificate options in 2025
#5I don't disagree with anything they say here:
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/#short...
But... How often do these types of compromises happen? I can't say I've ever seen or heard of it happening.
Re: Six day and IP address certificate options in 2025
#6I remember being surprised when Cloudflare launched https://1.1.1.1 with a valid cert and I immediately wanted one, but couldn’t find an easy way to get one.
I am gonna try to run a DoH resolver on this and see how it goes.
Re: Six day and IP address certificate options in 2025
#7> Our six-day certificates will not include OCSP or CRL URLs. If someone else did this, Mozilla would be threatening to remove them from their trusted roots. IP address certs sound like a security nightmare that could be subverted by BGP hijacking. Which is why most CAs don't issue them. Does accessing the ACME challenge from multiple endpoints adequately prevent this type of attack?
Not true. CA's are explicitly allowed to omit CRL support for certificates with a lifetime <= 10 days.
> §1.6.1 Definitions
> Short-lived Subscriber Certificate: For Certificates issued on or after 15 March 2024 and prior to 15 March 2026, a Subscriber Certificate with a Validity Period less than or equal to 10 days (864,000 seconds). For Certificates issued on or after 15 March 2026, a Subscriber Certificate with a Validity Period less than or equal to 7 days (604,800 seconds).
[…]
> §7.1.2.11.2 CRL Distribution Points
> The CRL Distribution Points extension MUST be present in: Subordinate CA Certificates; and Subscriber Certificates that 1) do not qualify as “Short-lived Subscriber Certificates” and 2) do not include an Authority Information Access extension with an id-ad-ocspaccessMethod.
* https://cabforum.org/working-groups/server/baseline-requirem...
OCSP does not seem to be mandated in the latest Base Requirements.
Re: Six day and IP address certificate options in 2025
#8[deleted]
Re: Six day and IP address certificate options in 2025
#9>We expect to issue the first valid short-lived certificates to ourselves in February of this year. Around April we will enable short-lived certificates for a small set of early adopting subscribers. We hope to make short-lived certificates generally available by the end of 2025.
Re: Six day and IP address certificate options in 2025
#10Note that ACME profiles are new, to the extent that the draft spec is (a) personal (and not prefixed with draft-ietf…), and (b) currently versioned -00:
* https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/
The ACME spec is: