News for hackers. Stuff that matters.
Re:Forthcoming OpenSSL releases by sneak on Monday July 06, 2015 @07:42PM (#9842814)
This doesn't really work without the certificate expiration date also being 24-48h in the future, though.

I think they reissue the same 1y+ validity cert...

Re:Forthcoming OpenSSL releases by iancarroll on Monday July 06, 2015 @07:53PM (#9842851)
Some allow manually specifying the expiration times.
Re:Forthcoming OpenSSL releases by skuhn on Tuesday July 07, 2015 @03:34AM (#9844068)
Entrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day.

I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.