4 ms·
Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.
by drtillberg 7y ago
Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.
- cyphar 7y agoBecause if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.
- bscphil 7y ago>By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)
- looperhacks 7y agoIn addition to what the other user said: if your certificate expires after a few years, it may take you a few years to notice it. And by then you probably don't know how you set up the not working process or don't even work at the company anymore.