4 ms·

Can someone explain why letsencrypt certificates have to be 90 days expiry? I know there is automation available, but what is the rationale for 90 days?

pastel8739 10mo ago
I’ve heard one rationale that it is short enough to force you to set up the automation, but don’t know if this was actually a consideration or not
cortesoft 10mo ago
You can just read their explanation: https://letsencrypt.org/2015/11/09/why-90-days https://letsencrypt.org/2015/11/09/why-90-days Tl;dr is to limit damage from leaked certs and to encourage automation.
- ChrisArchitect 10mo ago
  Related recently: Decreasing Certificate Lifetimes to 45 Days https://news.ycombinator.com/item?id=46117126 https://news.ycombinator.com/item?id=46117126
Lammy 10mo ago
It's so annoying. Eventually we will get to the point that every connection will have its own unique certificate, and so any compromised CA will be able to be “tapped” for a particular target without anybody else being able to compare certs and figure it out.
figmert 10mo ago
Others have already given your answer, but heads up, LE is lowering the certificate lifetime to 45 days[0]. - [0] https://letsencrypt.org/2025/12/02/from-90-to-45 https://letsencrypt.org/2025/12/02/from-90-to-45
eimrine 10mo ago
The best computer possible on the Earth today can crack it for 91 days in the best case for him.
crote 10mo ago
Because companies can't be trusted to set up proper renewal procedures. If a cert has to be renewed once every 3 years, plenty of companies will build an extremely complicated bureaucratic dance around the process. In the past this has resulted in CAs saying "something went wrong, and we should revoke, but Bank X is in a Holiday Freeze and won't be able to rotate any time in the next two months, and they are Critical Infrastructure!". Similarly, companies have ended up trying to sue their CA to block an inconvenient revocation. Most of those have luckily been due to small administrative errors, but it has painfully shown that the industry is institutionally incapable of setting up proper renewal processes. The solution is automated renewal as you can't make that too complicated, and by shortening the cert validity they are trying to make manual renewal too painful to keep around. After all, you can't set up a two-months-long process if you need to renew every 30 days!

pastel8739 10mo ago

I’ve heard one rationale that it is short enough to force you to set up the automation, but don’t know if this was actually a consideration or not

cortesoft 10mo ago

You can just read their explanation: https://letsencrypt.org/2015/11/09/why-90-days https://letsencrypt.org/2015/11/09/why-90-days Tl;dr is to limit damage from leaked certs and to encourage automation.

ChrisArchitect 10mo ago
Related recently: Decreasing Certificate Lifetimes to 45 Days https://news.ycombinator.com/item?id=46117126 https://news.ycombinator.com/item?id=46117126

Lammy 10mo ago

It's so annoying. Eventually we will get to the point that every connection will have its own unique certificate, and so any compromised CA will be able to be “tapped” for a particular target without anybody else being able to compare certs and figure it out.

figmert 10mo ago

Others have already given your answer, but heads up, LE is lowering the certificate lifetime to 45 days[0]. - [0] https://letsencrypt.org/2025/12/02/from-90-to-45 https://letsencrypt.org/2025/12/02/from-90-to-45

eimrine 10mo ago

The best computer possible on the Earth today can crack it for 91 days in the best case for him.

crote 10mo ago

Because companies can't be trusted to set up proper renewal procedures. If a cert has to be renewed once every 3 years, plenty of companies will build an extremely complicated bureaucratic dance around the process. In the past this has resulted in CAs saying "something went wrong, and we should revoke, but Bank X is in a Holiday Freeze and won't be able to rotate any time in the next two months, and they are Critical Infrastructure!". Similarly, companies have ended up trying to sue their CA to block an inconvenient revocation. Most of those have luckily been due to small administrative errors, but it has painfully shown that the industry is institutionally incapable of setting up proper renewal processes. The solution is automated renewal as you can't make that too complicated, and by shortening the cert validity they are trying to make manual renewal too painful to keep around. After all, you can't set up a two-months-long process if you need to renew every 30 days!