3 ms·

This is awesome, just replaced my self-signed ssl with it. Great Thanks!! so the cert will expire in 90 days, how to deal with that? come to the same site ever

• desireco42 11y ago
  If you find out, I would like to know as well.
  • mappu 11y ago
    Let's Encrypt is designed to encourage setting up an automated renewal system. If you follow the links, you won't have to renew within 90 days - or ever again.
• Tushon 11y ago
  One of their goals is to not have people use this interface and instead automate the workflow completely (using a client and your own renewal script[0], full docs [1]). There are reasons for this, laid out here[2]. [0]:https://letsencrypt.org/howitworks/ https://letsencrypt.org/howitworks/ [1]:https://letsencrypt.readthedocs.org/en/latest/intro.html https://letsencrypt.readthedocs.org/en/latest/intro.html [2]:https://community.letsencrypt.org/t/pros-and-cons-of-90-day-certificate-lifetimes/4621 https://community.letsencrypt.org/t/pros-and-cons-of-90-day-...
• spiffytech 11y ago
  This is a manual version of what's meant to be an automated process. I believe the idea is that certificate revocation is a big mess right now, with Chrome not using the main revocation registry, and other browsers not being great at checking / enforcing revocations. So the EFF decided that since automated certificate regeneration makes how often a cert expires irrelevant, they should use short-lived certificates so compromised certs can only be used maliciously for a short window, regardless of how well any given browser honors revocation registries. I can't speak to whether this manual version of Let's Encrypt has flexibility in choosing certificate lifespans.