Let's Encrypt is offering 6-day and IP address certs

Re:Let's Encrypt is offering 6-day and IP address certs by tptacek on Thursday January 16, 2025 @06:56PM (#42732499)

If you're using LetsEncrypt without automation you're doing it wrong, and the reason that the WebPKI is so hacky is that it was insulated from basic computer science for 2 decades and run by enterprise software companies.

You have to automate certificates. You can't do these by hand anymore. Certificate lifetimes are going to get inexorably shorter.

[ Parent | on HN ]

Re:Let's Encrypt is offering 6-day and IP address certs by xorcist on Thursday January 16, 2025 @08:08PM (#42732950)

Not really. PKI has always been that way since before the web. Mainly because the use cases are so varied and it there is the tendency to support every possibility under the sun.

For the longest time the web PKI lacked a singular view on what exactly they were supposed to be signing. Its usage reflects that.

That is deeply rooted in culture. I mean, we do speak about a culture in which X.509 was a reasonable choice. Years after the X.500 universe was cold to the touch at that.

The rest of your comment seems directed at someone else. Framing this on automation is misleading, which is what the examples in my comment were intended to show.

[ Parent | on HN ]

Re:Let's Encrypt is offering 6-day and IP address certs by ryandrake on Friday January 17, 2025 @10:56AM (#42739087)

Wow, I came back to this thread and it unexpectedly blew up. Looks like my experience is not normal and L.E. is not flaky for anyone else on HN. Who knew my simple 6 line shell script has been buggy for a decade.

I guess if you zoom out, one of the things I bristle with is LetsEncrypt's opinionated way of changing people's behavior. The short certificates were a deliberate decision, done to "get users to do X." They were pretty transparent about it. In my view, computers should do what users want them to do, not what developers want users to do. We've got enough software out there with notifications and consent dialogs begging users to do this and that, and this just adds to the problem.

I get that the software is free (which was a revolution in the PKI world at the time), but the short lifespan seems to be either a behavior modification experiment OR an annoyance to get people to fork over money for the better (better for users, not necessarily for security), longer-lived products.

[ Parent | on HN ]

Re:Let's Encrypt is offering 6-day and IP address certs by tptacek on Friday January 17, 2025 @12:04PM (#42740379)

The short certificates aren't just a random opinion LetsEncrypt had that they decided to inflict on everybody; it's a recognition of the fact that revocation doesn't work, and so it's important to reduce the blast radius of a compromised certificate. There's now a broad consensus on this in the field. I understand your frustration, but you're going to have to get used to this one.

It is, pretty obviously, not a weird scheme to get you to pay for certificates at some other CA.

[ Parent | on HN ]