Let's Encrypt: Reliability via Automated Renewal Information

Re:Let's Encrypt: Reliability via Automated Renewal Information by piperswe on Friday March 24, 2023 @02:17PM (#35293336)

Short TLS certificate lifetimes mean that the CA checks to ensure the certificate owner actually controls the DNS once every 3 months, so it's less likely someone will have a certificate for a domain they only had control of for a temporary period.

[ Parent | on HN ]

Re:Let's Encrypt: Reliability via Automated Renewal Information by cm2187 on Friday March 24, 2023 @02:20PM (#35293387)

And I think the rationale is also to force people to automate the process which is a good thing.

[ Parent | on HN ]

Re:Let's Encrypt: Reliability via Automated Renewal Information by detourdog on Friday March 24, 2023 @03:27PM (#35294242)

I don't understand this sentiment. Once the process is automatic it won't be managed or monitored.

[ Parent | on HN ]

Re:Let's Encrypt: Reliability via Automated Renewal Information by cm2187 on Friday March 24, 2023 @03:35PM (#35294344)

Well, even large companies do a crap job at managing and monitoring the renewal of certificates manually. There has been many occurences of large companies (including Microsoft or Linkedin) leaving some certificate expire.

[ Parent | on HN ]

Re:Let's Encrypt: Reliability via Automated Renewal Information by detourdog on Friday March 24, 2023 @03:44PM (#35294435)

Right and I don't expect them to manage an automatic process any better. I'm saying that there should be a form of trust for long standing stable environments.

[ Parent | on HN ]

Re:Let's Encrypt: Reliability via Automated Renewal Information by adql on Friday March 24, 2023 @04:11PM (#35294773)

You don't need to control the domain (only for wildcards), ability to serve under .well-known is enough.

[ Parent | on HN ]