4 ms·

The relevant section of the CA/Browser forum requirements that resulted in this change are here: https://cabforum.org/working-groups/server/baseline-requirement

• ptman 11mo ago
  That's the decision. Do you know the reasoning?
  • cpach 11mo ago
    The primary reason: Revocation doesn’t work for webscale (OCSP is now obsolete). So instead, shorter cert lifetimes.
    • cpach 11mo ago
      PS. Saw this insightful comment over on Lobsters: “One quantitative benefit is that the maximum lifetime of certificates sets a bound on the size of certificate revocation lists. John Schanck has done heroic work on CRLite at Mozilla to compress CRLs, and the reduction from 398 days to 47 days further shrinks them by a factor of more than 8. For Let’s Encrypt the current limit is 90, so a more modest but still useful factor of 2.” https://lobste.rs/s/r2bamx/decreasing_certificate_lifetimes_45#c_ye0n7e https://lobste.rs/s/r2bamx/decreasing_certificate_lifetimes_...