Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow. All publicly-trusted Certificate Authorities like Let’s Encrypt will be making similar changes. Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient.

Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028.
This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow. All publicly-trusted Certificate Authorities like Let’s Encrypt will be making similar changes. Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient.

  • atzanteol@sh.itjust.worksEnglish
    843·
    15 hours ago

    Will we need to log in every morning and expect to refresh every damn site cert we connect to soon?

    Automate your certificate renewals. You should be automating updates for security anyway.

    • Goose@piefed.socialEnglish
      1·
      1 hour ago

      That’s a lot easier said that done for hobbyists that need a certificate for their home server. I will give you a real world example. I run Ubuntu Linux (but without snaps) on my main desktop machine, however like the person you replied to I am old and I don’t have a good memory so when I do use Linux I try to take the easiest approach possible. But I also have a server running on a Raspberry Pi, and another family member (that has a Mac) that I exchange XMPP-based instant messages with. The server runs Prosody, and on my Ubuntu box I run Gajim (the one from the apt repository which is version 1.8.4, I have no idea why they won’t put a newer version in the repo). The other family member uses some MacOS-based XMPP client. The problem is that if there is not a valid certificate on the server, Gajim refuses to send or receive anything other than plain-text messages. It won’t sent or receive files or pictures, etc. unless the certificate is valid.

      However the Raspberry Pi does other things as well (it would be silly to dedicate a Pi to just running Prosody) and one of those other things puts a pseudo-web server of sorts on port 80, which is only accessible from the local network. So I can’t use Certbot because it insists on being able to connect to a web server. Even if I had a general web server on the Pi, which I don’t have and don’t want, it would be restricted for local access only. Also, I’m not paying for a DNS address for my own home server. What I found I could do is get a DuckDNS address (they are free) and use that to get a LE certificate. But the procedure is very manual and kind of convoluted, you have to ssh into the server using two separate sessions and enter some information in each one, because of the absolutely asinine way LE’s renewal process works if you don’t have a web server. I hate doing it every 90 days and if I have to do it every 45 days I’ll probably just give up on sending and receiving files.

      I should also mention that it took me hours to figure out the procedure i am using now, and it seems so stupid because I have that server locked down with two firewalls (one on the router and then iptables on the server) I don’t even want a certificate but the designers of Gajim in their infinite wisdom(?) decided not to give users the option to in effect say “I trust this server, just ignore an expired or missing certificate.” And the designers of LE never seemed to consider that some people might need a certificate that are not running a web server (and don’t want to run one) and provide some automatic mechanism for renewing in that situation. And just because someone uses Linux does not mean we are all programmers or expert script writers. I can follow “cookbook” type instructions (that is the ONLY way I got Prosody set up) but I can’t write a script or program to automate this process (again, I’m OLD).

      I know somebody’s going to be tempted to say I should use some other software (other that Prosody or Gajim). I tried other IM clients and Gajim is the only one that works the way I expect it to. As for Prosody, I have from time to time tried setting up other XMPP servers that people have suggested and could never get any of them to work. As I said, had I not found “cookbook” type instructions for setting up Prosody I would probably not be running that either, it was a PITA to get working but not that it IS working I don’t want to go through that again. And Prosody isn’t the problem, it works perfectly fine without a valid certificate, but pretty much every Linux IM client I have tried either loses functionality or won’t work at all if the server doesn’t have a valid certificate. And no I don’t run or use Docker, nor do I have any desire to (especially on a Raspberry Pi).

    • billwashere@lemmy.worldEnglish
      5·
      9 hours ago

      But can you imagine the load on their servers should it come to this? And god forbid it goes down for a few hours and every person in the world is facing SSL errors because Let’s Encrypt can’t create new ones.

      This continued shortening of lifespans on these certs is untenable at best. Personally I have never run into a situation where a cert was stolen or compromised but obviously that doesn’t mean it doesn’t happen. I also feel like this is meant to automate all cert production which is nice if you can. Right now, at my job, all cert creation requires manually generating a CSR, submit it to a website, wait for manager approval, and then wait for creation. Then go download the cert and install it manually.

      If I have to do this everyday for all my certs I’m not going to be happy. Yes this should be automated and central IT is supposed to be working on it but I’m not holding my breath.

      • Yggstyle@lemmy.worldEnglish
        1·
        1 hour ago

        I doubt they will drop below 1-2 weeks. Any service outage would turn into a ddos when service was restored.

      • redjard@lemmy.dbzer0.comEnglish
        1·
        2 hours ago

        The entire renewal process is fairly cheap, resource wise. 7 day certificates are already a thing.
        In terms of bandwidth you could easily renew a billion certificates a day over a gigabit connection, and in terms of performance I recon even without specialized hardware a single system could keep up with that, though that also depends on the signature algorithms employed in the future of course.

        The dependence on these servers is the far bigger problem I’d say.
        This shortening of lifetimes is a slow change, so I hope there will be solutions before it becomes an issue. Like keeping multiple copies of certificates alive with different providers, so the one in use can silently fall through when one provider stops working. Currently there are too few providers for my taste, that would have to improve for such a system to be viable.

        Maybe one day you’ll select a bundle of 5 certificate services with similar policies for creating your certificate the way you currently select a single one in certbot or acme.sh

    • dan@upvote.auEnglish
      371·
      15 hours ago

      This is one of the reasons they’re reducing the validity - to try and convince people to automate the renewal process.

      That and there’s issues with the current revocation process (for incorrectly issued certificates, or certificates where the private key was leaked or stored insecurely), and the most effective way to reduce the risk is to reduce how long any one certificate can be valid for.

      A leaked key is far less useful if it’s only valid or 47 days from issuance, compared to three years. (note that the max duration was reduced from 3 years to 398 days earlier this year).

      From https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days:

      In the ballot, Apple makes many arguments in favor of the moves, one of which is most worth calling out. They state that the CA/B Forum has been telling the world for years, by steadily shortening maximum lifetimes, that automation is essentially mandatory for effective certificate lifecycle management.

      The ballot argues that shorter lifetimes are necessary for many reasons, the most prominent being this: The information in certificates is becoming steadily less trustworthy over time, a problem that can only be mitigated by frequently revalidating the information.

      The ballot also argues that the revocation system using CRLs and OCSP is unreliable. Indeed, browsers often ignore these features. The ballot has a long section on the failings of the certificate revocation system. Shorter lifetimes mitigate the effects of using potentially revoked certificates. In 2023, CA/B Forum took this philosophy to another level by approving short-lived certificates, which expire within 7 days, and which do not require CRL or OCSP support.