5 ms·
These short certificate lifetimes make Let's Encrypt a central point of failure for much of the Internet. That's a concern. Failure may be technical or politica
by Animats 11mo ago
These short certificate lifetimes make Let's Encrypt a central point of failure for much of the Internet. That's a concern. Failure may be technical or political, too.
- Sesse__ 11mo agoThere are other free ACME-based providers, so switching should be fairly painless if needed. (I guess if you've issued CAA records or similar, you may need some manual intervention.)
- Animats 11mo agoYou can have more than one CAA record, so it should be possible to configure backup certificate authorities. It's probably a good idea to do that for important sites.
- gethly 11mo agoName one, baseide the NSA run Cloudflare.
- madeofpalk 11mo agoACME https://guide.actalis.com/ssl/activation/acme https://guide.actalis.com/ssl/activation/acme Google https://pki.goog/ https://pki.goog/ SSL.com https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/ https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-... ZeroSSL https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ I don't actually think Cloudflare runs an ACME Certificate Authority. They just partner with LetsEncrypt? Edit: Looks like they don't run any CA, they just delegate out to a bunch of others https://developers.cloudflare.com/ssl/reference/certificate-authorities/ https://developers.cloudflare.com/ssl/reference/certificate-...
- bigbuppo 11mo agoDoesn't matter. This is a push by the CA/Browser Forum. Google, Mozilla, and all the CAs got together and said, "hey, what if we just made certificates shorter because we're too stupid to figure out a revocation mechanism that actually works other than expiration." They've tried this shit before, but saner heads prevailed. This time they did not.
- tptacek 11mo agoShorter lifetimes strongly push customers towards ACME and thus away from commercial CAs, so it's odd to suggest that CAs subverted this process.
- ekr____ 11mo agoMozilla does have a revocation mechanism that actually works. https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
- deleted 11mo ago[deleted]
- Havoc 11mo ago>Let's Encrypt a central point of failure That's been true for a while, regardless of cert length. Everyone leans on them and unlike CF and other choke points of the internet...Let's Encrypt is a non-profit
- loloquwowndueo 11mo agoYou say it like it’s a bad thing. Do you donate to them? I do !
- Havoc 11mo ago>Do you donate to them? yes
- lysace 11mo agoAgreed. We need a second source, preferably located in the EU. They could share operational code/protocols/etc. I.e. during peace time they could collaborate. The EU started building the Galileo GNSS ("GPS") in 2008 as a backup in case the US turned hostile. And now look where we are in 2025 with the US president openly talking about taking Greenland. Wise move. It seemed like a gigantic waste back then. It was really, really expensive. Then lots of European countries ordered F35s from Lockheed Martin. What an own goal. This includes Denmark/Greenland. But i digress...
- darkwater 11mo agoActalis is European, Italian to be more precise, owned by Aruba (if that last thing is good or not can be probably discussed, though).
- Cu3PO42 11mo agoZeroSSL is Austrian, however since I last looked at them it appears they were acquired by a US corporation.
- alwillis 11mo ago> We need a second source, preferably located in the EU. Absolutely. It feels like a matter of time before the current US administration will attempt to implement some authoritarian policy regarding certificates.
- ocdtrekkie 11mo agoI am at the point of looking forward to it. The CA/B is so unhinged and so unaccountable and the appetite to fix it is so small, a broad scale collapse of the Internet caused by the CA/B's incompetence is looking like the only way to finally end their regime.
- Starlevel004 11mo agoHere's the key takeaways as to why that's an issue
- woodruffw 11mo agoCan you explain how shorter certificate lifetimes make LE more of a single point of failure? I can squint and see an argument for CA diversity; I struggle to see how reducing certificate lifetimes increases CA centralization.
- sethhochberg 11mo agoShorter lifetimes means more renewal events, which means more individual occasions in which LE (or whatever other cert authority) simply must be available before sites start falling off the internet for lack of ability to renew in time. We're not quite there yet, but the logical progression of shorter and shorter certificate lifetimes to obviate the problems related to revocation lists would suggest that we eventually end up in a place where the major ACME CAs join the list of heavily-centralized companies which are dependencies of "the internet", alongside AWS, Cloudflare, and friends. With cert lifetimes measured in years or months, the CA can have a bad day and as long as you didn't wait until the last possible minute to renew, you're unimpacted. With cert lifetimes trending towards days or less, now your CA really does need institutionally important levels of high availability. Its less that LE becomes more of a single point of failure than it is that the concept of ACME CAs in general join the list of critically available things required to keep a site online.
- woodruffw 11mo ago> would suggest that we eventually end up in a place where the major ACME CAs join the list of heavily-centralized companies which are dependencies of "the internet" I think that particular ship sailed a decade ago! > Its less that LE becomes more of a single point of failure than it is that the concept of ACME CAs in general join the list of critically available things required to keep a site online. Okay, this is what I wanted clarified. I don't disagree that CAs are critical infrastructure, and that there's latent risk whenever infrastructure becomes critical. I just think that risk is justified, and that LE in particular is no more or less of a SPOF with these policy changes.
- PunchyHamster 11mo agoif you renew 7 days before cert ends, it would need to be down for entire week in worst case so it' far less bad in general. Hell, you can still set it to renew when cert still have month left. I'm more worried that the clowns at the helm will push into something stupid like week or 3 days, "coz it improves security in some theoretical case"
- JackSlateur 11mo agoNo There are other CA with ACME support Including paying CA, if you really want to pay : sectigo
- bigbuppo 11mo agoSectigo is also going to be forced into issuing short-lived certificates. This is a CA/Browser Forum decision that is binding on all member CAs.
- Dylan16807 11mo agoThey will, but Sectigo forcing faster renewal doesn't make Let's Encrypt into a central failure point. Central failure point was the worry above.
- JackSlateur 11mo agoBut sectigo does not care, they are just like Let's Encrypt (except you pay) You can renew your sectigo certificates with ACME so from a technical point of view, just trigger your cron more often
- LunaSea 11mo agoAWS still generates yearly certs.
- JackSlateur 11mo agoIn april 2026, they will generate certificates with a 200 days validity period
- stusmall 11mo agoI'm seeing this hot take a lot but it doesn't make sense. Are people worried than LE is going to have a 45 day outage or something? ACME is an open standard with other implementations so I'm having trouble seeing the political central point of failure too. It's okay for something to be a good thing and to celebrate it. We don't have to frown about everything.
- patmorgan23 11mo agoYeah, doesn't the ACME bot defaults have it trying to renew the cert when it has like 30% of its life time left? Which means the CA would have to be down for Days/Weeks fo it to impact production. Oh and you would definitely know about this outage because you would hear about it in your news, and the monitoring you already have set up to yell at you when you cert is about to retire (you already have that right? Right?). And you can STILL trivially switch to another CA that supports ACME.
- SchemaLoad 11mo agoFor this to be a problem LE would have to be broken for an entire month. And even then you'd have ample time to move to something else.
- tecleandor 11mo agoThis is not a Let's Encrypt policy. This is a global policy: https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days https://www.digicert.com/blog/tls-certificate-lifetimes-will...