4 ms·
Two ideas for discussion. Certificate Transparency is used to account for maliciously or mistakenly issued certificates. Perhaps it could also be used to asser
by sowbug 3y ago
Two ideas for discussion.
Certificate Transparency is used to account for maliciously or mistakenly issued certificates. Perhaps it could also be used to assert the unavailability of correctly issued but obsolete certificates that are believed to be purged but actually aren't. (Services like KeyChest might already do this.)
Let's Encrypt is a miracle compared to the expensive pain of getting a cert 20 years ago. Rather than resting on laurels, would there be any benefit to renewing even more frequently, like daily? This might have confined the Tailscale incident to a quick "oops!" while the provider migration was still underway and being actively watched.
- striking 3y ago90 day renewal is frequent enough in my book. It's not so often as to be easy to miss, but often enough that the person setting it up can witness the first renewal cycle (if they so choose, which in this case they apparently did not).
- sowbug 3y agoRight. I was thinking of keeping the same 90-day validity but renewing much more frequently, rather than the 60-day period that LE recommends. But I can see my questions have irked other community members, so I'll leave it at that. :)
- starttoaster 3y agoI renew some of my LetsEncrypt certificates monthly, which should be plenty, in my opinion. Gets you about 2 buffer cycles to notice the certificate isn't updating and recognize an issue in your automation.
- pluto_modadic 3y agois this a good amount of not overwhelming the system? e.g. they recommend 60 days? https://letsencrypt.org/2015/11/09/why-90-days https://letsencrypt.org/2015/11/09/why-90-days - and folks say the bot process won't let you do it unless it's within 30 days of expiring? (but this might not be limited by the server-side API, because --force-renewal exists)