6 ms·

The certificate lifetime decrease, to 45 days, was discussed in: https://news.ycombinator.com/item?id=46117126 https://news.ycombinator.com/item?id=46117126 Th

by btown 10mo ago

The certificate lifetime decrease, to 45 days, was discussed in: https://news.ycombinator.com/item?id=46117126 https://news.ycombinator.com/item?id=46117126 This isn't LE's decision: a 47 day max was voted on by the CA/Browser Forum. https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days https://www.digicert.com/blog/tls-certificate-lifetimes-will... https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/ https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-sch... https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/bvWh5RN6tYI?pli=1 https://groups.google.com/a/groups.cabforum.org/g/servercert... - public votes of all members, which were unanimously Yes or Abstain. IMO this is a policy change that can Break the Internet, as many archived/legacy sites on old-school certificates may not be able to afford the upfront tech or ongoing labor to transition from annual to effectively-monthly renewals, and will simply be shut down. And, per other comments, this will make LE the only viable option to modernize, and thus much more of a central point of failure than before. But Let's Encrypt is not responsible for this move, and did not vote on the ballot.

jsheard 10mo ago
> And, per other comments, this will make LE the only viable option to modernize, and thus much more of a central point of failure than before. Let's Encrypt isn't the only free ACME provider, you can take your pick from them, ZeroSSL, SSL.com, Google and Actalis, or several of them for redundancy. If you use Caddy that's even the default behavior - it tries ZeroSSL first and automatically falls back to Let's Encrypt if that fails for whatever reason.
- autotune 10mo ago
  LE has some gnarly rate limiting rules, so I use ZeroSSL. Works out great for my purposes.
  - OptionOfT 10mo ago
    That's the reason I switched. I had an issue where a path was not mounted correctly and we blew through our limits. Oh, on LE the Rate Limit Adjustment Request forms the contractual things (if that's what they are?) do not load: https://isrg.formstack.com/forms/rate_limit_adjustment_request https://isrg.formstack.com/forms/rate_limit_adjustment_reque...
    - mcpherrinm 10mo ago
      Hm, it's supposed to be https://letsencrypt.org/docs/integration-guide/ https://letsencrypt.org/docs/integration-guide/ - but it looks like the link is broken. I'll fix it.
- xg15 10mo ago
  How are all those free CAs financed?
  - jsheard 10mo ago
    Let's Encrypt is a non-profit funded by donations and corporate sponsorships. ZeroSSL, SSL.com and Actalis offer paid services on top of their basic free certificates. Google is Google.
    - xg15 10mo ago
      Ah, that makes sense. Thanks!
    - bigiain 10mo ago
      > Google is Google. So your "free" ssl certs are provided by surveillance capitalism, and paid for with your privacy (and probably your website user's privacy too)?
      - jsheard 10mo ago
        The ethical side is up to you, but in a strictly technical sense I don't think there's much that Google could do to intrude on your users privacy as a result of them issuing your SSL certificate, even if they wanted to. AIUI the ACME protocol never lets the CA see the private key, only the public key, which is public by definition anyway. A more realistic concern with using Googles public CA is they may eventually get bored and shut it down, as they tend to do. It would be prudent to have a backup CA lined up.
        oooyay 10mo ago
        > The ethical side is up to you, but in a strictly technical sense I don't think there's much that Google could do to intrude on your users privacy as a result of them issuing your SSL certificate, even if they wanted to. I'm not sure that's technically true. As a CA they definitely have the power to facilitate a MitM attack. They can also issue fraudulent certificates. > AIUI the ACME protocol never lets the CA see the private key, only the public key, which is public by definition anyway. That has more to do with HTTPS end to end encryption, not the protocol of issuance.
- idoubtit 10mo ago
  > If you use Caddy that's even the default behavior - it tries ZeroSSL first and automatically falls back to Let's Encrypt if that fails for whatever reason. No, that's false. It's the other way around. “If Caddy cannot get a certificate from Let's Encrypt, it will try with ZeroSSL”. Source: https://caddyserver.com/docs/automatic-https#issuer-fallback https://caddyserver.com/docs/automatic-https#issuer-fallback Which makes sense, since the ACME access to ZeroSSL must go through an account created by a manual registration step. Unless the landscape changed very recently, LE is still the only free ACME that does not require registration. Source: https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/#acme-ca-info https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/#acme-ca...
  - jsheard 10mo ago
    My bad, I misremembered the order. You're right that ZeroSSL requires credentials to get free certificates, but Caddy has special-case support for generating those credentials automatically provided you specify an email address in the config, so it's almost transparent to the user. https://caddy.community/t/using-zerossls-acme-endpoint/9406 https://caddy.community/t/using-zerossls-acme-endpoint/9406 Correction: the default behavior is to use Let's Encrypt alone, but if you provide an email then it's Let's Encrypt with fallback to ZeroSSL.
tgsovlerkhgsel 10mo ago
It will make ACME the only viable option. I believe there is a second free ACME CA and other CAs will likely adopt ACME if they want to stay relevant. Ideally, this will take less ongoing labor than annual manual rotations, and I'd argue sites that can't handle this would have been likely to break at the next annual rotation anyways. If they have certificates managed by hosters, the hosters will deal with it. If they don't, then someone was already paying for the renewal and handling the replacement on the server side, making it much more likely that it will be fixed.
- deleted 10mo ago
  [deleted]
- michaelt 10mo ago
  I'm quite surprised the CA/Browser Forum went for this. Nobody's paying for EV certificates now browsers don't display the EV details. The only reason to pay for a certificate is if you're rotating certificates manually, and the 90 day expiry of Lets Encrypt certificates is a hassle. If the CA/Browser Forum is forcing everyone to run ACME clients (or outsource to a managed provider like AWS or Cloudflare) doesn't that eliminate the last substantial reason to give money to a CA?
  - joking 10mo ago
    My case, I have to manage a portal for old tvs and those don’t accept the LE root certificate since they changed a couple of years ago. Unfortunately the vendor is unable to update the firmware with new certificates and we are sold
    - aftbit 10mo ago
      Yeah that LE root certificate change broke our PROD for about 25% of traffic when it happened. Everyone acts like we control our client's cert chains. Clients don't look at the failure and think "our system is broken - we should upgrade". They look at the connection failure and think "this vendor is busted - might as well switch to someone who works". I switched away from LE to the other free ACME provider for our public-facing certs after that.
gcr 10mo ago
Note the timeline. Nothing's changing soon. > Next year, you’ll be able to opt-in to 45 day certificates for early adopters and testing via the tlsserver profile. In 2027, we’ll lower the default certificate lifetime to 64 days, and then to 45 in 2028.
- 1718627440 10mo ago
  You have a different definition of soon than me.
bigbuppo 10mo ago
The good news is that the CAs signed their own death warrant with this change. If switching to ACME is more or less mandatory, what purpose do paid certificates serve? Your options are to use LE, switch to non-CA-issued encryption, or drop encryption entirely.
- xg15 10mo ago
  New web features are https-only by default, since a few years ago. So if your site uses any recent APIs, dropping encryption is not an option.
  - zozbot234 10mo ago
    Secure context is only required for features that are somehow privacy- or security-sensitive. Some notable features are on the list, but you can absolutely have a modern site that doesn't rely on any of these.
    - manindahat 10mo ago
      Securing your communications is required to mitigate against main in the middle attacks.
- nickf 10mo ago
  You assume it’s just the certs being purchased - and not support, SLAs, other related products, management platforms, private PKI and more. If all you do is public TLS, sure, that might be an issue.
- briHass 10mo ago
  Paid certs are valid for 1-year from the $$ CAs. LE certs are only good for ~3-4 months before they have to be reissued. If there's no easy way to do an automated ACME setup to handle the renewal, being able to defer that for a year is worth the $20 or $70 for a wildcard. If paid certs drop in max validity period, then yeah, zero reason to burn money for no reason.
reactordev 10mo ago
Certificate rotation/renewal has been the biggest headache of my IT career. It’s always after the fact. It’s always a pain point. It’s always an argument with accounting over costs. It sucks. I’m glad ACME exists but man this whole thing is a cluster fuck. Whole IT teams are just going to wash their hands of this and punt to a provider or their cloud IaaS.
- echelon 10mo ago
  It's fine for fintechs and social accounts to require SSL, but do blogs really need certs? You know what blogs I'm reading from my DNS requests anyway. I doubt anyone is going to MITM my access to an art historian's personal website. There is zero need for security theater here. All of these required, complex, constantly moving components mean we're beholden to larger tech companies and can't do things by ourselves anymore without increasing effort. It also makes it easier for central government to start revoking access once they put a thumb on cert issuance. Parties that the powers don't like can be pruned through cert revocation. In the future issuance may be limited to parties with state IDs. And because mainstream tech is now incompatible with any other distribution method, you suddenly lose the ability to broadcast ideas if you fall out of compliance. The levers of 1984.
  - omcnoe 10mo ago
    Without TLS on your blog anyone in the middle can trivially inject malware to all your readers.
    - lousken 10mo ago
      it still can, just add some 3rd party javascript or unpatched backend app
      - vntok 10mo ago
        How do you inject anything into a TLS served webpage as an equipment-in-between without the cert's key?
bigstrat2003 10mo ago
> IMO this is a policy change that can Break the Internet Unfortunately, the people making these decisions simply do not care how they impact actual real world users. It happens over and over that browser makers dictate something that makes sense in a nice, pure theoretical context, but sucks ass for everyone stuck in the real world with all its complexities and shortcomings.
- bigfatkitten 10mo ago
  “Browser makers” in this context generally just means Google, though this particular proposal came from Clint Wilson from Apple. Google calls the shots and the others fall in line.
RedShift1 10mo ago
I have been saying it since the beginning that we are centralizing all the power of the internet to one organization and that this a bad thing, yet I get downvoted every time. One organization is going to have a say on whether or not you can have a website on the internet, how is this objectively a good thing?
- Dylan16807 10mo ago
  The CA/Browser forum has massive power over the web whether you like it or not, because they make the browsers. And make no mistake, it's the browser representatives that are the most aggressive about tighter security and shorter certificate lives.
  - RedShift1 10mo ago
    I have the feeling that this is much more about control than it is about security.
- tssva 10mo ago
  Maybe you get downvoted because this isn't centralizing all the power of the internet to one organization rather than being downvoted because people don't have an issue with that.
- bruce511 10mo ago
  I'll upvote you for at least asking the question. But you get downvoted because your premise is wrong. There are lots of organizations that support the ACME protocol. LE is the most well known, but there are others, and more on the way. Existing CAs don't necessarily vanish with this change. They are free to implement ACME (or some proprietary protocol) and they are completely free to keep charging for certificates if they like. The real result of this change is that processes will change (where they haven't already) improving both customer experience and security. But to be clear there's no "one organization" in the loop here. You can rest easy on that front.
evandena 10mo ago
Will the browsers only be forcing the 47 day limit for publicly-trusted CAs?
- cpach 10mo ago
  Yes.
patmorgan23 10mo ago
Nginx and Apache are free and both can be trivially automated with ACME bot. Both can be used to set up a reverse proxy in front of legacy sites or applications. This is not centralizing everything to Let's Encrypt. it's forcing everyone to use ACME, and many CAs support ACME (and those that don't probably will soon due to this change).
ycombinatrix 10mo ago
This is Google's doing, just like the Client Authentication EKU debacle.
toddgardner 10mo ago
It's more complicated than that. Apple (along with Google and Mozilla) basically held the CA's hostage. They started unilaterally reducing lifetimes. It was happening whether the CAB approved it or not. The vote was more about whether the CAB would continue to be relevant. "Accept the reality, or browsers aren't even going to show up anymore". I wrote a bunch about this recently: https://www.certkit.io/blog/47-day-certificate-ultimatum https://www.certkit.io/blog/47-day-certificate-ultimatum
- btown 10mo ago
  Thanks for this history, I wasn't aware. It's an interesting point that if this is happening anyways by Apple's fiat, it's in the legacy CAs' interest to even further accelerate the mandatory timeline, so they can pivot to consulting services for their existing customers. I do still feel that "that blog/publication that had immense cultural impact years ago, that was acquired/put on life support with annual certificate updates, will now be taken offline rather than migrated to a system that can support ACME automations, because the consultants charge more than the ad revenue" will be an unfortunate class of casualty. But that's progress, I suppose.
  - tptacek 10mo ago
    I think it's more broadly "browsers vs. CAs", I think the balance of power shifted sharply after the Symantec distrusting, and I think very few people on HN would prefer the status quo ante of that power shift if we laid out what it meant. Today, people are complaining that automation of certificate renewals are annoying (I'm sure they were). Before that, the complaint was that random US companies were simply buying and deploying their own root certificates, issuing certs for arbitrary strangers domains, so their IT teams wouldn't have to update their desktop configurations. Things are better now.
- Analemma_ 10mo ago
  It's interesting that this is pretty much identical to the WHATWG/W3C situation: there is theoretically a standards body, but in practice it's defunct; the browsers announce what they will ship, and the "standards body" can do nothing but meekly comply. The difference being that there's at least a little bit of popular dissatisfaction with the status quo of browsers unilaterally dictating web standards, whereas no one came to the defense of CAs, since everybody hated them. A useful lesson that you need to do reputation management even if you're running a successful racket, since if people hate you enough they might not stick up for you even if someone comes for you "illegally".
grayhatter 10mo ago
> But Let's Encrypt is not responsible for this move, and did not vote on the ballot. "Did not vote", and "not responsible", is definitely a take... They could call their bluff. I would. The CA/browser forum made a mistake here. And they can only get away with it if the players involved comply. Browers have an incentive to increase the complexity, good engineers would resist that.
sunaookami 10mo ago
>IMO this is a policy change that can Break the Internet, as many archived/legacy sites on old-school certificates may not be able to afford the upfront tech or ongoing labor to transition from annual to effectively-monthly renewals, and will simply be shut down. This is just fear-mongering, legacy sites still need to update their tech and going fully automatic for cert renewals leads to less maintenance burden then renewing them manually.

by btown 10mo ago

jsheard 10mo ago

> And, per other comments, this will make LE the only viable option to modernize, and thus much more of a central point of failure than before. Let's Encrypt isn't the only free ACME provider, you can take your pick from them, ZeroSSL, SSL.com, Google and Actalis, or several of them for redundancy. If you use Caddy that's even the default behavior - it tries ZeroSSL first and automatically falls back to Let's Encrypt if that fails for whatever reason.

autotune 10mo ago
LE has some gnarly rate limiting rules, so I use ZeroSSL. Works out great for my purposes.
- OptionOfT 10mo ago
  That's the reason I switched. I had an issue where a path was not mounted correctly and we blew through our limits. Oh, on LE the Rate Limit Adjustment Request forms the contractual things (if that's what they are?) do not load: https://isrg.formstack.com/forms/rate_limit_adjustment_request https://isrg.formstack.com/forms/rate_limit_adjustment_reque...
  - mcpherrinm 10mo ago
    Hm, it's supposed to be https://letsencrypt.org/docs/integration-guide/ https://letsencrypt.org/docs/integration-guide/ - but it looks like the link is broken. I'll fix it.
xg15 10mo ago
How are all those free CAs financed?
- jsheard 10mo ago
  Let's Encrypt is a non-profit funded by donations and corporate sponsorships. ZeroSSL, SSL.com and Actalis offer paid services on top of their basic free certificates. Google is Google.
  - xg15 10mo ago
    Ah, that makes sense. Thanks!
  - bigiain 10mo ago
    > Google is Google. So your "free" ssl certs are provided by surveillance capitalism, and paid for with your privacy (and probably your website user's privacy too)?
    - jsheard 10mo ago
      The ethical side is up to you, but in a strictly technical sense I don't think there's much that Google could do to intrude on your users privacy as a result of them issuing your SSL certificate, even if they wanted to. AIUI the ACME protocol never lets the CA see the private key, only the public key, which is public by definition anyway. A more realistic concern with using Googles public CA is they may eventually get bored and shut it down, as they tend to do. It would be prudent to have a backup CA lined up.
      - oooyay 10mo ago
        > The ethical side is up to you, but in a strictly technical sense I don't think there's much that Google could do to intrude on your users privacy as a result of them issuing your SSL certificate, even if they wanted to. I'm not sure that's technically true. As a CA they definitely have the power to facilitate a MitM attack. They can also issue fraudulent certificates. > AIUI the ACME protocol never lets the CA see the private key, only the public key, which is public by definition anyway. That has more to do with HTTPS end to end encryption, not the protocol of issuance.
idoubtit 10mo ago
> If you use Caddy that's even the default behavior - it tries ZeroSSL first and automatically falls back to Let's Encrypt if that fails for whatever reason. No, that's false. It's the other way around. “If Caddy cannot get a certificate from Let's Encrypt, it will try with ZeroSSL”. Source: https://caddyserver.com/docs/automatic-https#issuer-fallback https://caddyserver.com/docs/automatic-https#issuer-fallback Which makes sense, since the ACME access to ZeroSSL must go through an account created by a manual registration step. Unless the landscape changed very recently, LE is still the only free ACME that does not require registration. Source: https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/#acme-ca-info https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/#acme-ca...
- jsheard 10mo ago
  My bad, I misremembered the order. You're right that ZeroSSL requires credentials to get free certificates, but Caddy has special-case support for generating those credentials automatically provided you specify an email address in the config, so it's almost transparent to the user. https://caddy.community/t/using-zerossls-acme-endpoint/9406 https://caddy.community/t/using-zerossls-acme-endpoint/9406 Correction: the default behavior is to use Let's Encrypt alone, but if you provide an email then it's Let's Encrypt with fallback to ZeroSSL.

tgsovlerkhgsel 10mo ago

It will make ACME the only viable option. I believe there is a second free ACME CA and other CAs will likely adopt ACME if they want to stay relevant. Ideally, this will take less ongoing labor than annual manual rotations, and I'd argue sites that can't handle this would have been likely to break at the next annual rotation anyways. If they have certificates managed by hosters, the hosters will deal with it. If they don't, then someone was already paying for the renewal and handling the replacement on the server side, making it much more likely that it will be fixed.

deleted 10mo ago
[deleted]
michaelt 10mo ago
I'm quite surprised the CA/Browser Forum went for this. Nobody's paying for EV certificates now browsers don't display the EV details. The only reason to pay for a certificate is if you're rotating certificates manually, and the 90 day expiry of Lets Encrypt certificates is a hassle. If the CA/Browser Forum is forcing everyone to run ACME clients (or outsource to a managed provider like AWS or Cloudflare) doesn't that eliminate the last substantial reason to give money to a CA?
- joking 10mo ago
  My case, I have to manage a portal for old tvs and those don’t accept the LE root certificate since they changed a couple of years ago. Unfortunately the vendor is unable to update the firmware with new certificates and we are sold
  - aftbit 10mo ago
    Yeah that LE root certificate change broke our PROD for about 25% of traffic when it happened. Everyone acts like we control our client's cert chains. Clients don't look at the failure and think "our system is broken - we should upgrade". They look at the connection failure and think "this vendor is busted - might as well switch to someone who works". I switched away from LE to the other free ACME provider for our public-facing certs after that.

gcr 10mo ago

Note the timeline. Nothing's changing soon. > Next year, you’ll be able to opt-in to 45 day certificates for early adopters and testing via the tlsserver profile. In 2027, we’ll lower the default certificate lifetime to 64 days, and then to 45 in 2028.

1718627440 10mo ago
You have a different definition of soon than me.

bigbuppo 10mo ago

The good news is that the CAs signed their own death warrant with this change. If switching to ACME is more or less mandatory, what purpose do paid certificates serve? Your options are to use LE, switch to non-CA-issued encryption, or drop encryption entirely.

xg15 10mo ago
New web features are https-only by default, since a few years ago. So if your site uses any recent APIs, dropping encryption is not an option.
- zozbot234 10mo ago
  Secure context is only required for features that are somehow privacy- or security-sensitive. Some notable features are on the list, but you can absolutely have a modern site that doesn't rely on any of these.
  - manindahat 10mo ago
    Securing your communications is required to mitigate against main in the middle attacks.
nickf 10mo ago
You assume it’s just the certs being purchased - and not support, SLAs, other related products, management platforms, private PKI and more. If all you do is public TLS, sure, that might be an issue.
briHass 10mo ago
Paid certs are valid for 1-year from the $$ CAs. LE certs are only good for ~3-4 months before they have to be reissued. If there's no easy way to do an automated ACME setup to handle the renewal, being able to defer that for a year is worth the $20 or $70 for a wildcard. If paid certs drop in max validity period, then yeah, zero reason to burn money for no reason.

reactordev 10mo ago

Certificate rotation/renewal has been the biggest headache of my IT career. It’s always after the fact. It’s always a pain point. It’s always an argument with accounting over costs. It sucks. I’m glad ACME exists but man this whole thing is a cluster fuck. Whole IT teams are just going to wash their hands of this and punt to a provider or their cloud IaaS.

echelon 10mo ago
It's fine for fintechs and social accounts to require SSL, but do blogs really need certs? You know what blogs I'm reading from my DNS requests anyway. I doubt anyone is going to MITM my access to an art historian's personal website. There is zero need for security theater here. All of these required, complex, constantly moving components mean we're beholden to larger tech companies and can't do things by ourselves anymore without increasing effort. It also makes it easier for central government to start revoking access once they put a thumb on cert issuance. Parties that the powers don't like can be pruned through cert revocation. In the future issuance may be limited to parties with state IDs. And because mainstream tech is now incompatible with any other distribution method, you suddenly lose the ability to broadcast ideas if you fall out of compliance. The levers of 1984.
- omcnoe 10mo ago
  Without TLS on your blog anyone in the middle can trivially inject malware to all your readers.
  - lousken 10mo ago
    it still can, just add some 3rd party javascript or unpatched backend app
    - vntok 10mo ago
      How do you inject anything into a TLS served webpage as an equipment-in-between without the cert's key?

bigstrat2003 10mo ago

> IMO this is a policy change that can Break the Internet Unfortunately, the people making these decisions simply do not care how they impact actual real world users. It happens over and over that browser makers dictate something that makes sense in a nice, pure theoretical context, but sucks ass for everyone stuck in the real world with all its complexities and shortcomings.

bigfatkitten 10mo ago
“Browser makers” in this context generally just means Google, though this particular proposal came from Clint Wilson from Apple. Google calls the shots and the others fall in line.

RedShift1 10mo ago

I have been saying it since the beginning that we are centralizing all the power of the internet to one organization and that this a bad thing, yet I get downvoted every time. One organization is going to have a say on whether or not you can have a website on the internet, how is this objectively a good thing?

Dylan16807 10mo ago
The CA/Browser forum has massive power over the web whether you like it or not, because they make the browsers. And make no mistake, it's the browser representatives that are the most aggressive about tighter security and shorter certificate lives.
- RedShift1 10mo ago
  I have the feeling that this is much more about control than it is about security.
tssva 10mo ago
Maybe you get downvoted because this isn't centralizing all the power of the internet to one organization rather than being downvoted because people don't have an issue with that.
bruce511 10mo ago
I'll upvote you for at least asking the question. But you get downvoted because your premise is wrong. There are lots of organizations that support the ACME protocol. LE is the most well known, but there are others, and more on the way. Existing CAs don't necessarily vanish with this change. They are free to implement ACME (or some proprietary protocol) and they are completely free to keep charging for certificates if they like. The real result of this change is that processes will change (where they haven't already) improving both customer experience and security. But to be clear there's no "one organization" in the loop here. You can rest easy on that front.

evandena 10mo ago

Will the browsers only be forcing the 47 day limit for publicly-trusted CAs?

cpach 10mo ago
Yes.

patmorgan23 10mo ago

Nginx and Apache are free and both can be trivially automated with ACME bot. Both can be used to set up a reverse proxy in front of legacy sites or applications. This is not centralizing everything to Let's Encrypt. it's forcing everyone to use ACME, and many CAs support ACME (and those that don't probably will soon due to this change).

ycombinatrix 10mo ago

This is Google's doing, just like the Client Authentication EKU debacle.

toddgardner 10mo ago

It's more complicated than that. Apple (along with Google and Mozilla) basically held the CA's hostage. They started unilaterally reducing lifetimes. It was happening whether the CAB approved it or not. The vote was more about whether the CAB would continue to be relevant. "Accept the reality, or browsers aren't even going to show up anymore". I wrote a bunch about this recently: https://www.certkit.io/blog/47-day-certificate-ultimatum https://www.certkit.io/blog/47-day-certificate-ultimatum

btown 10mo ago
Thanks for this history, I wasn't aware. It's an interesting point that if this is happening anyways by Apple's fiat, it's in the legacy CAs' interest to even further accelerate the mandatory timeline, so they can pivot to consulting services for their existing customers. I do still feel that "that blog/publication that had immense cultural impact years ago, that was acquired/put on life support with annual certificate updates, will now be taken offline rather than migrated to a system that can support ACME automations, because the consultants charge more than the ad revenue" will be an unfortunate class of casualty. But that's progress, I suppose.
- tptacek 10mo ago
  I think it's more broadly "browsers vs. CAs", I think the balance of power shifted sharply after the Symantec distrusting, and I think very few people on HN would prefer the status quo ante of that power shift if we laid out what it meant. Today, people are complaining that automation of certificate renewals are annoying (I'm sure they were). Before that, the complaint was that random US companies were simply buying and deploying their own root certificates, issuing certs for arbitrary strangers domains, so their IT teams wouldn't have to update their desktop configurations. Things are better now.
Analemma_ 10mo ago
It's interesting that this is pretty much identical to the WHATWG/W3C situation: there is theoretically a standards body, but in practice it's defunct; the browsers announce what they will ship, and the "standards body" can do nothing but meekly comply. The difference being that there's at least a little bit of popular dissatisfaction with the status quo of browsers unilaterally dictating web standards, whereas no one came to the defense of CAs, since everybody hated them. A useful lesson that you need to do reputation management even if you're running a successful racket, since if people hate you enough they might not stick up for you even if someone comes for you "illegally".

grayhatter 10mo ago

> But Let's Encrypt is not responsible for this move, and did not vote on the ballot. "Did not vote", and "not responsible", is definitely a take... They could call their bluff. I would. The CA/browser forum made a mistake here. And they can only get away with it if the players involved comply. Browers have an incentive to increase the complexity, good engineers would resist that.

sunaookami 10mo ago

>IMO this is a policy change that can Break the Internet, as many archived/legacy sites on old-school certificates may not be able to afford the upfront tech or ongoing labor to transition from annual to effectively-monthly renewals, and will simply be shut down. This is just fear-mongering, legacy sites still need to update their tech and going fully automatic for cert renewals leads to less maintenance burden then renewing them manually.