3 ms·
>Why isn't it instead just a minute? or a few seconds? Wouldn't that be better? Then if your CA went down for an hour, you would go down too. With 47 days, the
by Thorrez 1y ago
>Why isn't it instead just a minute? or a few seconds? Wouldn't that be better?
Then if your CA went down for an hour, you would go down too. With 47 days, there's plenty of time for the CA to fix the outage and issue you a new cert before your current one expires.
- 8organicbits 1y agoLots of ACME software supports configuring CA fallbacks, so even if a CA is down hard for an extended period you can issue certificates with the others. Using LetsEncrypt and ZeroSSL together is a popular approach. If you need a stronger guarantee of uptime, reach for the paid options. https://github.com/acmesh-official/acme.sh?tab=readme-ov-file#supported-ca https://github.com/acmesh-official/acme.sh?tab=readme-ov-fil...
- Thorrez 1y agoIf everyone uses that with 1 minute or 1 second expirations, I could certainly see a case where an outage in 1 CA causes traffic migration to another, causing performance issues on the fallback CA too. >If you need a stronger guarantee of uptime, reach for the paid options. We don't. If we had 1 minute or 1 second lifetimes, we would.
- 8organicbits 1y agoOh, agreed. I was responding to the part about extended outages.