3 ms·

There are other free ACME-based providers, so switching should be fairly painless if needed. (I guess if you've issued CAA records or similar, you may need some

by Sesse__ 10mo ago

There are other free ACME-based providers, so switching should be fairly painless if needed. (I guess if you've issued CAA records or similar, you may need some manual intervention.)

Animats 10mo ago
You can have more than one CAA record, so it should be possible to configure backup certificate authorities. It's probably a good idea to do that for important sites.
gethly 10mo ago
Name one, baseide the NSA run Cloudflare.
- madeofpalk 10mo ago
  ACME https://guide.actalis.com/ssl/activation/acme https://guide.actalis.com/ssl/activation/acme Google https://pki.goog/ https://pki.goog/ SSL.com https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/ https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-... ZeroSSL https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ I don't actually think Cloudflare runs an ACME Certificate Authority. They just partner with LetsEncrypt? Edit: Looks like they don't run any CA, they just delegate out to a bunch of others https://developers.cloudflare.com/ssl/reference/certificate-authorities/ https://developers.cloudflare.com/ssl/reference/certificate-...
  - gethly 10mo ago
    Those are just providers that support the ACME protocol, not free certificate providers.
    - teraflop 10mo ago
      Google and ZeroSSL both provide free certificates via ACME. The links posted above have more details.
bigbuppo 10mo ago
Doesn't matter. This is a push by the CA/Browser Forum. Google, Mozilla, and all the CAs got together and said, "hey, what if we just made certificates shorter because we're too stupid to figure out a revocation mechanism that actually works other than expiration." They've tried this shit before, but saner heads prevailed. This time they did not.
- tptacek 10mo ago
  Shorter lifetimes strongly push customers towards ACME and thus away from commercial CAs, so it's odd to suggest that CAs subverted this process.
- ekr____ 10mo ago
  Mozilla does have a revocation mechanism that actually works. https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
- deleted 10mo ago
  [deleted]

by Sesse__ 10mo ago

There are other free ACME-based providers, so switching should be fairly painless if needed. (I guess if you've issued CAA records or similar, you may need some manual intervention.)

Animats 10mo ago

You can have more than one CAA record, so it should be possible to configure backup certificate authorities. It's probably a good idea to do that for important sites.

gethly 10mo ago

Name one, baseide the NSA run Cloudflare.

madeofpalk 10mo ago
ACME https://guide.actalis.com/ssl/activation/acme https://guide.actalis.com/ssl/activation/acme Google https://pki.goog/ https://pki.goog/ SSL.com https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/ https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-... ZeroSSL https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ I don't actually think Cloudflare runs an ACME Certificate Authority. They just partner with LetsEncrypt? Edit: Looks like they don't run any CA, they just delegate out to a bunch of others https://developers.cloudflare.com/ssl/reference/certificate-authorities/ https://developers.cloudflare.com/ssl/reference/certificate-...
- gethly 10mo ago
  Those are just providers that support the ACME protocol, not free certificate providers.
  - teraflop 10mo ago
    Google and ZeroSSL both provide free certificates via ACME. The links posted above have more details.

bigbuppo 10mo ago

Doesn't matter. This is a push by the CA/Browser Forum. Google, Mozilla, and all the CAs got together and said, "hey, what if we just made certificates shorter because we're too stupid to figure out a revocation mechanism that actually works other than expiration." They've tried this shit before, but saner heads prevailed. This time they did not.

tptacek 10mo ago
Shorter lifetimes strongly push customers towards ACME and thus away from commercial CAs, so it's odd to suggest that CAs subverted this process.
ekr____ 10mo ago
Mozilla does have a revocation mechanism that actually works. https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
deleted 10mo ago
[deleted]