3 ms·
On a side note, I've had fun playing with something like this with Caddy and StepCA and bind running in a homelab. I've managed to, using the rfc2136 plugin, ma
by samgranieri 2y ago
On a side note, I've had fun playing with something like this with Caddy and StepCA and bind running in a homelab. I've managed to, using the rfc2136 plugin, managed to rotate certs every ten minutes.
Every six days is fine, just use something like Caddy that rotates the certs for you and it should just be set it and forget it.
Yes, I realize this is a bit glib.
- crote 2y agoYeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet. A big part of the reason why shorter cert validity is desirable is because CAs routinely violate the mandatory revocation deadline, usually with an argument which boils down to "$BigOrg doesn't want to". And they don't want to because they have developed an extremely complicated manual process around certificate renewal, sometimes requiring weeks from end to end. Luckily most of the cert issues are primarily administrative, but it does show what the PKI infrastructure will most likely be unable to timely respond to an incident with real-world consequences. The major browsers are already planning to reduce the validity of all certificates to 90 days or even less, and LetsEncrypt serves a nice role by showing everyone that high-frequency renewal is indeed possible. After all, if a nonprofit can do it surely a well-paid CA wouldn't have any issues with it? By normalizing short certificate lifetimes they are essentially forcing the industry to innovate. Either make sure everything using certs has an API which allows for automatic renewal, or stop using the public PKI infrastructure and run your own private CA.