4 ms·

It's funny because LE's stance has been that 90-day certs are cool because it is easy to automate renewal. However, no one bothered to set up renewal on their e

• dijit 10y ago
  if you read the posters comment he explains why, they had to leave the original cert with the hash in place while the CA was being validated, despite it being expired.
• pfg 10y ago
  You're missing the point here. helloworld.letsencrypt.org was used as the Test URL in the root inclusion ticket[1]. The certificate was renewed multiple times[2], but the expired certificate had to be restored at one point in order to satisfy some of the requirements of the root inclusion process. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 [2]: https://crt.sh/?q=helloworld.letsencrypt.org https://crt.sh/?q=helloworld.letsencrypt.org
• ubernostrum 10y ago
  The use of an expired certificate on that domain is deliberate due to the circumstances around the procedures required to get trusted. Here's the full explanation: https://www.reddit.com/r/programming/comments/4wb7c2/lets_encrypt_root_certificate_trusted_by_mozilla/d65x42w https://www.reddit.com/r/programming/comments/4wb7c2/lets_en...