4 ms·

I find it a little hilarious that the cert for the Test URL, https://helloworld.letsencrypt.org https://helloworld.letsencrypt.org is a 90-day certificate that

I find it a little hilarious that the cert for the Test URL, https://helloworld.letsencrypt.org https://helloworld.letsencrypt.org is a 90-day certificate that is expired as of a long time ago. https://i.imgur.com/1bQLHuF.png https://i.imgur.com/1bQLHuF.png

joecool1029 10y ago
If you read through the linked bug inside the bug, I think they had to do that as part of the review process. They had to wait 90 days after the initial cert was issued to have it reviewed. Since LE only issues 90 day certs this means they'd have to review an expired one. The whole Mozilla CA review process is a little crazy and the thread talks about ways they could reform it in the future. (overview: https://wiki.mozilla.org/CA https://wiki.mozilla.org/CA )
- discreditable 10y ago
  It's funny because LE's stance has been that 90-day certs are cool because it is easy to automate renewal. However, no one bothered to set up renewal on their example server.
  - dijit 10y ago
    if you read the posters comment he explains why, they had to leave the original cert with the hash in place while the CA was being validated, despite it being expired.
  - pfg 10y ago
    You're missing the point here. helloworld.letsencrypt.org was used as the Test URL in the root inclusion ticket[1]. The certificate was renewed multiple times[2], but the expired certificate had to be restored at one point in order to satisfy some of the requirements of the root inclusion process. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 [2]: https://crt.sh/?q=helloworld.letsencrypt.org https://crt.sh/?q=helloworld.letsencrypt.org
  - ubernostrum 10y ago
    The use of an expired certificate on that domain is deliberate due to the circumstances around the procedures required to get trusted. Here's the full explanation: https://www.reddit.com/r/programming/comments/4wb7c2/lets_encrypt_root_certificate_trusted_by_mozilla/d65x42w https://www.reddit.com/r/programming/comments/4wb7c2/lets_en...

joecool1029 10y ago

If you read through the linked bug inside the bug, I think they had to do that as part of the review process. They had to wait 90 days after the initial cert was issued to have it reviewed. Since LE only issues 90 day certs this means they'd have to review an expired one. The whole Mozilla CA review process is a little crazy and the thread talks about ways they could reform it in the future. (overview: https://wiki.mozilla.org/CA https://wiki.mozilla.org/CA )

discreditable 10y ago
It's funny because LE's stance has been that 90-day certs are cool because it is easy to automate renewal. However, no one bothered to set up renewal on their example server.
- dijit 10y ago
  if you read the posters comment he explains why, they had to leave the original cert with the hash in place while the CA was being validated, despite it being expired.
- pfg 10y ago
  You're missing the point here. helloworld.letsencrypt.org was used as the Test URL in the root inclusion ticket[1]. The certificate was renewed multiple times[2], but the expired certificate had to be restored at one point in order to satisfy some of the requirements of the root inclusion process. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 [2]: https://crt.sh/?q=helloworld.letsencrypt.org https://crt.sh/?q=helloworld.letsencrypt.org
- ubernostrum 10y ago
  The use of an expired certificate on that domain is deliberate due to the circumstances around the procedures required to get trusted. Here's the full explanation: https://www.reddit.com/r/programming/comments/4wb7c2/lets_encrypt_root_certificate_trusted_by_mozilla/d65x42w https://www.reddit.com/r/programming/comments/4wb7c2/lets_en...