3 ms·
When we wrote Certbot, we thought (by analogy with prior practice) that many sysadmins would want to manually inspect certificates before deploying them! That's
by schoen 3y ago
When we wrote Certbot, we thought (by analogy with prior practice) that many sysadmins would want to manually inspect certificates before deploying them! That's one reason that we kept old certificates around and used a symlink-updating system.
As it turned out, misissued and invalid certs account for an incredibly small fraction of Let's Encrypt's issuance volume (I'm going to say < 1/10⁸ offhand?) and manual inspection kind of gets in the way of automation, so the idea of separating these steps has come to seem kind of quaint, for me at least. I've also helped thousands of people on the Let's Encrypt forum and I think at most 2 have said they were interested in looking at their new certs' contents before starting to use them.
- tedunangst 3y agoI may not inspect it myself (which wouldn't even catch this issue), but letting it simmer for a week isn't hard.
- agwa 3y agoThat's a pretty good idea, and would also mitigate clients with slow clocks rejecting a certificate for not being valid yet.
- toast0 3y agoOr clients with poor handling of dates. It's been a while, but Nokia Series 40 was really bad at this. As I recall, it would read the not-before as if the time was specified in local time. So not before noon UTC becomes not before noon wherever you are, so better wait a while for users in the americas.
- schoen 3y agoYeah, we originally were thinking of having separate times for renewal and deployment (e.g. 4 weeks before expiry and 3 weeks before expiry), but there was a countervailing concern that people would think "wait, my certificate has already been renewed but I can't see it on my site!" and get confused or alarmed.