The reduction to 398 days was imposed by Apple, unilaterally, although in practice the ecosystem went along with it. It actually took a few weeks to get clarity on exactly what Apple intended, they just basically blurted it out at a meeting.
- One year instead of two? Yep
- 3 months instead of 1 year? Yep.
- 1 week instead of 3 months? Yep.
The reason certificates have traditionally been so long is because it was a manual process. Using ACME it is possible to expire certificates every hour if you wanted to do that.
Now it seems that revocation is supposed to help the CA covering up mistakes made by the CA.
Maybe we actually need a better CA.
Go for it. Start one and tell us how it went.
So okay, maybe you don't have certs revoked and you don't need to restart your Traefik but are you really sure everything is okay?
Why do you think the maximum lifetime was reduced from two years to one?
Does it make a lick of difference if you’re man-in-the-middled for just one year instead of two? What kind of argument is that!?
“Oh, they got every active user credential and form that was submitted ages ago, but no worries! This won’t go on for another year! Just months to go now…”
No, obviously the CA cartel just wanted to extract 2x the rent.
The whole thing is just absurd on its face and needs to stop, but there are billions of dollars worth of rent seekers that say…
“No.”