4 ms·

> Why does LetsEncrypt expire the cert while the acme DNS entry is still there? That's like saying "why does the government expire my passport/driver's license

> Why does LetsEncrypt expire the cert while the acme DNS entry is still there? That's like saying "why does the government expire my passport/driver's license when I haven't changed my name". That's not how it works; the document is stamped valid for a specific amount of time, and you get a new document with a new expiration time when you renew it. The certificate from LE will expire automatically 90 days after it was provided, that's why you need to renew it before the 90 days are up. If you hate setting up automated certificate renewal, you can still get longer-lasting certificates from paid certificate providers. It used to be that you needed to pay a company to generate a certificate for you every year, now you just get the option to have a free one every 90 days. > Also, why not support file based auth in .well-known/acme-challenge/... for domain wide certs An ACME challenge file on a web server proves that you control a specific server at a specific domain, so you get a certificate for a specific domain. A DNS entry proves you control the entire domain, so you (can) get a certificate for the domain. By uploading a file to tekmol.freewebhost.com, you haven't proven that you control either .freewebhost.com or .tekmol.freewebhost.com. You have just proven that you control tekmol.freewebhost.com.

hn_throw2025 1y ago
> If you hate setting up automated certificate renewal, you can still get longer-lasting certificates from paid certificate providers. It used to be that you needed to pay a company to generate a certificate for you every year, now you just get the option to have a free one every 90 days. I took the easier route and let Cloudflare generate and handle certs for my domains. I’m on the free tier. I secure traffic between them and my host with an origin cert. By default those are valid for 15 years. I know CF is frequently criticised around here, but wanted to mention it as an option.
- jeroenhd 1y ago
  That works too, of course. You don't even need a specific certificate or even an open port by leveraging Cloudflare tunnels, which means you can host your website on a local server behind three layers of NAT if you had to. And it's not just Cloudflare; there are plenty of other redirect-everything-through-a-CDN hosts available. If you don't mind giving Cloudflare control of your website (and barring visitors from countries like India where CGNAT makes everyone fill out CAPTCHAs every page load), this approach will take care of just about everything.
  - hn_throw2025 1y ago
    Agreed. It’s about priorities and tradeoffs. I’ve been impressed with how much I get on the free tier (my sites are small). With the DDoS protections, rate limit, WAF rules, and Turnstile, it feels like I can keep a significant amount of abusive traffic from reaching my host. It’s a pretty compelling tradeoff for me, anyway.
sofixa 1y ago
> If you hate setting up automated certificate renewal, you can still get longer-lasting certificates from paid certificate providers. Not for much longer, the maximum lifetime of a public certificate will progressively go down to 47 days by March 2029.
dotancohen 1y ago
> That's like saying "why does the government expire my passport/driver's license when I haven't changed my name". That's not how it works; the document is stamped valid for a specific amount of time, and you get a new document with a new expiration time when you renew it. That does not answer the question, why?
- ericpauley 1y ago
  Because certificate lifetimes need to be determined when they’re issued. They aren’t dynamic and so can’t be changed in response to whether an acme challenge file exists.
AnthonyMouse 1y ago
The government expires your driver's license because they want to charge you for a renewal. You can tell that this is the only reason because it's the only thing they want in order to give you a new one. They do nothing to confirm that you still know how to drive. But Let's Encrypt doesn't charge anything. All they want is to confirm that you still control the domain. So why doesn't "the DNS record they had you add to begin with is still there" satisfy that requirement and allow you to repeatedly renew the certificate until it stops being there? Tie the DNS challenge to the public key in the certificate. Then as long as it hasn't changed you can update the certificate without giving the update process modify access to the DNS server.
- notakio 1y ago
  Regarding "the DNS record they had you add to begin with is still there", it generally isn't. Part of the automation process for certbot using the DNS-01 challenge is the removal of the DNS record, following successful validation of said record. In any complex DNS environment, leaving TXT records around just increases the debris.
  - AnthonyMouse 1y ago
    It's the Let's Encrypt people who make certbot, so that's just an implementation detail, and the premise here anyway is that you would be doing it manually (once) because the inconvenience to be avoided is when certbot can't update the DNS records automatically.
    - notakio 1y ago
      No, it's not the LetsEncrypt people who make certbot. Certbot is an EFF project, managed by separate people. Additionally, most of the DNS implementations will require the use of a specific plug-in/library for your selected DNS platform, and those, also, are developed separately.
      - AnthonyMouse 1y ago
bravesoul2 1y ago
Passport is a good example. So is bank notes. They expire to add new security features.
- 1718627440 1y ago
  Banknotes don't expire.
  - anticensor 1y ago
    Specific notes and coins do, despite the underlying money doesn't.
  - lxgr 1y ago
    There’s plenty that have. Just one example: https://en.wikipedia.org/wiki/Military_payment_certificate https://en.wikipedia.org/wiki/Military_payment_certificate Similar schemes have been used in the past as a forcing function against tax evasion or simply to phase out less secure older bills.
  - bravesoul2 1y ago
    In practical terms retailers can refuse old ones. In countries I have lived in.
TekMol 1y ago
You now have described the status quo in length. But you have not touched on why it is supposed to make sense. You have not provided attack vectors for the easier alternatives. By uploading a file to tekmol.freewebhost.com, you haven't proven that you control either .freewebhost.com Who said that putting a file on a subdomain should grant you a cert on the domain? Putting it on domain.com/.well-known/acme-challenge/ should.
- danaris 1y ago
  They attempted to indicate wildcards there, but HN ate them. That should say "you haven't proven that you control either *.freewebhost.com or *.tekmol.freewebhost.com". Now, I can definitely see there being a system where the owner of the root domain (eg, freewebhost.com) can set up something in their own .well-known directory that specifies that any subdomains can only declare certs for that specific subdomain, rather than being able to claim a wildcard, and then we can allow certs that sign wildcards in cases where such a limiter is not in place. In any case, this would only solve the DNS auth hurdle, not the overall expiration hurdle.
  - TekMol 1y ago
    solve the DNS auth hurdle, not the overall expiration hurdle That would already be a big step forward.

hn_throw2025 1y ago

> If you hate setting up automated certificate renewal, you can still get longer-lasting certificates from paid certificate providers. It used to be that you needed to pay a company to generate a certificate for you every year, now you just get the option to have a free one every 90 days. I took the easier route and let Cloudflare generate and handle certs for my domains. I’m on the free tier. I secure traffic between them and my host with an origin cert. By default those are valid for 15 years. I know CF is frequently criticised around here, but wanted to mention it as an option.

jeroenhd 1y ago
That works too, of course. You don't even need a specific certificate or even an open port by leveraging Cloudflare tunnels, which means you can host your website on a local server behind three layers of NAT if you had to. And it's not just Cloudflare; there are plenty of other redirect-everything-through-a-CDN hosts available. If you don't mind giving Cloudflare control of your website (and barring visitors from countries like India where CGNAT makes everyone fill out CAPTCHAs every page load), this approach will take care of just about everything.
- hn_throw2025 1y ago
  Agreed. It’s about priorities and tradeoffs. I’ve been impressed with how much I get on the free tier (my sites are small). With the DDoS protections, rate limit, WAF rules, and Turnstile, it feels like I can keep a significant amount of abusive traffic from reaching my host. It’s a pretty compelling tradeoff for me, anyway.

sofixa 1y ago

> If you hate setting up automated certificate renewal, you can still get longer-lasting certificates from paid certificate providers. Not for much longer, the maximum lifetime of a public certificate will progressively go down to 47 days by March 2029.

dotancohen 1y ago

> That's like saying "why does the government expire my passport/driver's license when I haven't changed my name". That's not how it works; the document is stamped valid for a specific amount of time, and you get a new document with a new expiration time when you renew it. That does not answer the question, why?

ericpauley 1y ago
Because certificate lifetimes need to be determined when they’re issued. They aren’t dynamic and so can’t be changed in response to whether an acme challenge file exists.

AnthonyMouse 1y ago

The government expires your driver's license because they want to charge you for a renewal. You can tell that this is the only reason because it's the only thing they want in order to give you a new one. They do nothing to confirm that you still know how to drive. But Let's Encrypt doesn't charge anything. All they want is to confirm that you still control the domain. So why doesn't "the DNS record they had you add to begin with is still there" satisfy that requirement and allow you to repeatedly renew the certificate until it stops being there? Tie the DNS challenge to the public key in the certificate. Then as long as it hasn't changed you can update the certificate without giving the update process modify access to the DNS server.

notakio 1y ago
Regarding "the DNS record they had you add to begin with is still there", it generally isn't. Part of the automation process for certbot using the DNS-01 challenge is the removal of the DNS record, following successful validation of said record. In any complex DNS environment, leaving TXT records around just increases the debris.
- AnthonyMouse 1y ago
  It's the Let's Encrypt people who make certbot, so that's just an implementation detail, and the premise here anyway is that you would be doing it manually (once) because the inconvenience to be avoided is when certbot can't update the DNS records automatically.
  - notakio 1y ago
    No, it's not the LetsEncrypt people who make certbot. Certbot is an EFF project, managed by separate people. Additionally, most of the DNS implementations will require the use of a specific plug-in/library for your selected DNS platform, and those, also, are developed separately.
    - AnthonyMouse 1y ago

bravesoul2 1y ago

Passport is a good example. So is bank notes. They expire to add new security features.

1718627440 1y ago
Banknotes don't expire.
- anticensor 1y ago
  Specific notes and coins do, despite the underlying money doesn't.
- lxgr 1y ago
  There’s plenty that have. Just one example: https://en.wikipedia.org/wiki/Military_payment_certificate https://en.wikipedia.org/wiki/Military_payment_certificate Similar schemes have been used in the past as a forcing function against tax evasion or simply to phase out less secure older bills.
- bravesoul2 1y ago
  In practical terms retailers can refuse old ones. In countries I have lived in.

TekMol 1y ago

You now have described the status quo in length. But you have not touched on why it is supposed to make sense. You have not provided attack vectors for the easier alternatives. By uploading a file to tekmol.freewebhost.com, you haven't proven that you control either .freewebhost.com Who said that putting a file on a subdomain should grant you a cert on the domain? Putting it on domain.com/.well-known/acme-challenge/ should.

danaris 1y ago
They attempted to indicate wildcards there, but HN ate them. That should say "you haven't proven that you control either *.freewebhost.com or *.tekmol.freewebhost.com". Now, I can definitely see there being a system where the owner of the root domain (eg, freewebhost.com) can set up something in their own .well-known directory that specifies that any subdomains can only declare certs for that specific subdomain, rather than being able to claim a wildcard, and then we can allow certs that sign wildcards in cases where such a limiter is not in place. In any case, this would only solve the DNS auth hurdle, not the overall expiration hurdle.
- TekMol 1y ago
  solve the DNS auth hurdle, not the overall expiration hurdle That would already be a big step forward.