Taking this opportunity to again expound about how not all websites need HTTPS: First, most of these are basically info portals. Nobody is trying to steal or c

Taking this opportunity to again expound about how not all websites need HTTPS: First, most of these are basically info portals. Nobody is trying to steal or corrupt the data points for the fiscal budget expenditures this year, or the report on residential heating in remote arctic villages. In addition, none of the data is secret or private. So the data doesn't need to be protected. The other reason people say everything needs HTTPS is not data security, but attacks on the client. If you use HTTP, someone can subvert the packets to inject malware into your client, etc. But this would be impossible if the browsers had methods to cryptographically verify the data's integrity without needing to keep it private. In other words a checksum, possibly even out-of-bound. This can be done securely and without the need to constantly expire and re-issue a certificate, and it also enables several useful technologies which require inspection and passing of data content in different scenarios. Finally, the increased dependence on encryption for all communication makes our communication more fragile, and this is a great example. In the future, if everything uses https, and certs expire, either most of the content of the web will expire, or if we allow clients and tools to not verify certificates, we undermine the purpose of the certificates to begin with. Let's Encrypt cron jobs will not work forever (if you don't upgrade, eventually the crypto you were using for your cert will become obsolete), network operations can be attacked to prevent re-signing, not every domain has a server that runs cron jobs, there's no guarantee Let's Encrypt will be around forever, and it may not work in non-US countries. Unrelated, but I also think expiring certificates can be worked around. They force you to expire and re-sign them because they could get cracked or (less likely) the private key could leak. But certificates can also be revoked at any time. As far as I can tell, it's not possible to tell if a certificate has been revoked if an attacker doesn't want you to be able to tell, since PKI has to work offline. So you could be getting pwned all the way up to the cert expiring. Instead, we could simply expire certificates when we want to rotate them, rather than letting them auto-die and catch unaware admins with their pants around their ankles. Some people say we need to get rid of PKI, but I don't think that's a good idea. Rather than throw the baby out with the bath water, let's improve the baby. That goes for the registrars, CAs and DNS, too. (The way cert signing happens today is, I think, a bit of a joke, and registrars need to play a more key role)