3 ms·

Agreed. My initial reaction when Let's Encrypt had you re-issue every 90 days was negative, but I was wrong. Very wrong. A 90 day re-issue forces you to have w

Agreed. My initial reaction when Let's Encrypt had you re-issue every 90 days was negative, but I was wrong. Very wrong. A 90 day re-issue forces you to have working re-issue infrastructure and procedures, and therefore you're less likely to get stung by an accidental expiration. Long expirations are a trap, a very easy trap to fall into.

drtillberg 8y ago
Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.
- cyphar 8y ago
  Because if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.
  - bscphil 8y ago
    >By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)
- looperhacks 8y ago
  In addition to what the other user said: if your certificate expires after a few years, it may take you a few years to notice it. And by then you probably don't know how you set up the not working process or don't even work at the company anymore.

drtillberg 8y ago

Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.

cyphar 8y ago
Because if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.
- bscphil 8y ago
  >By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)
looperhacks 8y ago
In addition to what the other user said: if your certificate expires after a few years, it may take you a few years to notice it. And by then you probably don't know how you set up the not working process or don't even work at the company anymore.