Re:Upcoming Changes to Let's Encrypt Certificates
by mboerwink on Monday December 15, 2025 @04:52PM
(#46281249)
PCI still recommends 90 day password changes. Luckily they've softened their stance to allow zero-trust to be used instead. They're not really equivalent controls, but clearly laid out as 'OR' in 8.3.9 regardless.
[ Parent
| on HN ]
Re:Upcoming Changes to Let's Encrypt Certificates
by jfindper on Monday December 15, 2025 @04:58PM
(#46281319)
I think it's only a requirement if passwords are the sole factor, correct? Any other factor or zero-trust or risk-based authentication exempts you from the rotation. It's been awhile since I've looked at anything PCI.
In any case, all my homies hate PCI.