4 ms·

CRL are a failure, OCSP can't scale, so to get some assurance that if the private key was compromised somewhat recently, it's either mandating OCSP stapling or

by brohee 3y ago

CRL are a failure, OCSP can't scale, so to get some assurance that if the private key was compromised somewhat recently, it's either mandating OCSP stapling or shorter lived certs... Why do you hate the short lifetimes?

dale_glass 3y ago
Why can't OCSP scale? Doesn't stapling help a lot with that?
- brohee 3y ago
  Stapling works, but is a lot more useful if it is mandatory (which it is not). OCSP as intended in the early 2000s where the client query the CA is a non starter, the hosting cost would be such that not only free certificates would end but the paying one would be much more expensive. I think most people will find short lived certificates more convenient than mandatory OCSP stapling.
JohnFen 3y ago
> Why do you hate the short lifetimes? Because they require more frequent maintenance. That has to happen either manually or through automation. LE seems to think that automation means that short lifetimes aren't painful, but I disagree -- if for no other reason than that there are plenty of places where automation is not feasible.
- brohee 3y ago
  Let's Encrypt isn't exactly hiding that it's only practical in the context of automation From their FAQ (https://letsencrypt.org/docs/faq/ https://letsencrypt.org/docs/faq/): What is the lifetime for Let’s Encrypt certificates? For how long are they valid? Our certificates are valid for 90 days. You can read about why here. There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.
  - JohnFen 3y ago
    Right. I never claimed that LE was hiding this fact. I'm just saying that requirement is very problematic for me and makes LE a suboptimal solution for my purposes.
- ryandrake 3y ago
  I agree with this. I use L.E. for a handful of hobby domains, and it seems every 3 months, something fails, and I have to ssh in and diagnose and re-run something and restart some processes. Yuck. I’d rather just get/configure certificates once, and not have to worry about them anymore. This feels like software that deletes its own config file every three months, just to make you write a script that regenerates the config. Make-work. It would be great to have a button “I understand the risks, give me a 5 year certificate.”

by brohee 3y ago

dale_glass 3y ago

Why can't OCSP scale? Doesn't stapling help a lot with that?

brohee 3y ago
Stapling works, but is a lot more useful if it is mandatory (which it is not). OCSP as intended in the early 2000s where the client query the CA is a non starter, the hosting cost would be such that not only free certificates would end but the paying one would be much more expensive. I think most people will find short lived certificates more convenient than mandatory OCSP stapling.

JohnFen 3y ago

> Why do you hate the short lifetimes? Because they require more frequent maintenance. That has to happen either manually or through automation. LE seems to think that automation means that short lifetimes aren't painful, but I disagree -- if for no other reason than that there are plenty of places where automation is not feasible.

brohee 3y ago
Let's Encrypt isn't exactly hiding that it's only practical in the context of automation From their FAQ (https://letsencrypt.org/docs/faq/ https://letsencrypt.org/docs/faq/): What is the lifetime for Let’s Encrypt certificates? For how long are they valid? Our certificates are valid for 90 days. You can read about why here. There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.
- JohnFen 3y ago
  Right. I never claimed that LE was hiding this fact. I'm just saying that requirement is very problematic for me and makes LE a suboptimal solution for my purposes.
ryandrake 3y ago
I agree with this. I use L.E. for a handful of hobby domains, and it seems every 3 months, something fails, and I have to ssh in and diagnose and re-run something and restart some processes. Yuck. I’d rather just get/configure certificates once, and not have to worry about them anymore. This feels like software that deletes its own config file every three months, just to make you write a script that regenerates the config. Make-work. It would be great to have a button “I understand the risks, give me a 5 year certificate.”