3 ms·

It might not have helped here, but updating certs every several years always leads to problems from my experience - people move on, processes get lost or outdat

It might not have helped here, but updating certs every several years always leads to problems from my experience - people move on, processes get lost or outdated, etc. I'll accept the yearly annoyance to avoid those issues every time.

Someone1234 7y ago
Agreed. My initial reaction when Let's Encrypt had you re-issue every 90 days was negative, but I was wrong. Very wrong. A 90 day re-issue forces you to have working re-issue infrastructure and procedures, and therefore you're less likely to get stung by an accidental expiration. Long expirations are a trap, a very easy trap to fall into.
- drtillberg 7y ago
  Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.
  - cyphar 7y ago
    Because if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.
    - bscphil 7y ago
      >By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)
  - looperhacks 7y ago
    In addition to what the other user said: if your certificate expires after a few years, it may take you a few years to notice it. And by then you probably don't know how you set up the not working process or don't even work at the company anymore.
shanxS 7y ago
Usually organisations of size of Mozilla have metrics and alarms for various things, cert expiry should have been on top priority.
- macintux 7y ago
  I’ve never worked in a company so large that certificate expiration was a completely solved problem. I’ve seen it bite every company I’ve worked for, and I’ve been part of ones much larger than Mozilla.
Twirrim 7y ago
Even with annual certificate renewal, I'd find I'd make mistakes and/or that things had changed in the intervening time. It's also infrequent enough to often remain a manual process when it really should be automated. That said, I still haven't automated renewal of my personal ones using LetsEncrypt, but it's also so simple I don't really need to. At any of my previous jobs where I've had to deal with certificates, a 90 day cycle would have guaranteed I'd have it down to at least just "run this script"

Someone1234 7y ago

Agreed. My initial reaction when Let's Encrypt had you re-issue every 90 days was negative, but I was wrong. Very wrong. A 90 day re-issue forces you to have working re-issue infrastructure and procedures, and therefore you're less likely to get stung by an accidental expiration. Long expirations are a trap, a very easy trap to fall into.

drtillberg 7y ago
Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.
- cyphar 7y ago
  Because if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.
  - bscphil 7y ago
    >By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)
- looperhacks 7y ago
  In addition to what the other user said: if your certificate expires after a few years, it may take you a few years to notice it. And by then you probably don't know how you set up the not working process or don't even work at the company anymore.

shanxS 7y ago

Usually organisations of size of Mozilla have metrics and alarms for various things, cert expiry should have been on top priority.

macintux 7y ago
I’ve never worked in a company so large that certificate expiration was a completely solved problem. I’ve seen it bite every company I’ve worked for, and I’ve been part of ones much larger than Mozilla.

Twirrim 7y ago

Even with annual certificate renewal, I'd find I'd make mistakes and/or that things had changed in the intervening time. It's also infrequent enough to often remain a manual process when it really should be automated. That said, I still haven't automated renewal of my personal ones using LetsEncrypt, but it's also so simple I don't really need to. At any of my previous jobs where I've had to deal with certificates, a 90 day cycle would have guaranteed I'd have it down to at least just "run this script"