Google wants to reduce lifespan for HTTPS certificates to one year

Re:Google wants to reduce lifespan for HTTPS certificates to... by ars on Sunday August 18, 2019 @01:17AM (#20728386)

What about an internal machine, with no outside [incoming] connectivity? But you don't want to install your own self signed certificate on everyone's browsers.

There's no way for letsencrypt to issue you a certificate because they can't connect to it from outside.

[ Parent | on HN ]

Re:Google wants to reduce lifespan for HTTPS certificates to... by skissane on Sunday August 18, 2019 @08:58PM (#20734046)

If you are using DNS challenge type, then LetsEncrypt doesn't have to talk to the internal service. You just need the name of the internal service to be in public DNS. (You don't even need its internal IP address in there, LetsEncrypt only looks at the TXT record of _acme-challenge.)

[ Parent | on HN ]

Re:Google wants to reduce lifespan for HTTPS certificates to... by ars on Monday August 19, 2019 @12:54AM (#20734985)

Thought of that, but you need DNS software that allows scripted updates. You also need company policies that allow this.

We gave up and paid for a certificate.

[ Parent | on HN ]