Our longstanding offering won't fundamentally change next year, but weSource:
are going to introduce a new offering that's a big shift from anything
we've done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
Thousands of people around the world make our work possible. Donate today. >...[end quoted plain text]
About Us
https://letsencrypt.org/about/
About Let's Encrypt
Let's Encrypt is a free, automated, and open certificate authority (CA), run for
the public's benefit. It is a service provided by the Internet Security Research
Group (ISRG).
We give people the digital certificates they need in order to enable HTTPS >(SSL/TLS) for websites, for free, in the most user-friendly way we can. We do this
because we want to create a more secure and privacy-respecting Web.
You can read about our most recent year in review by downloading our annual report.
The key principles behind Let's Encrypt are:
Free: Anyone who owns a domain name can use Let's Encrypt to obtain a trusted
certificate at zero cost.
Automatic: Software running on a web server can interact with Let's Encrypt to
painlessly obtain a certificate, securely configure it for use, and automatically
take care of renewal.
Secure: Let's Encrypt will serve as a platform for advancing TLS security best
practices, both on the CA side and by helping site operators properly secure
their servers.
Transparent: All certificates issued or revoked will be publicly recorded and
available for anyone to inspect.
Open: The automatic issuance and renewal protocol is published as an open
standard that others can adopt.
Cooperative: Much like the underlying Internet protocols themselves, Let's
Encrypt is a joint effort to benefit the community, beyond the control of any one
organization.
We have a page with more detailed information about how the Let's Encrypt CA works.
Support a more secure and privacy-respecting Web.
Donate
Let's Encrypt is a free, automated, and open certificate authority brought to you
by the nonprofit Internet Security Research Group (ISRG). Read all about our >nonprofit work this year in our 2024 Annual Report.
548 Market St, PMB 77519, San Francisco, CA 94104-5401, USA
Send all mail or inquiries to:
PO Box 18666, Minneapolis, MN 55418-0666, USA
GitHub
Mastodon
View our privacy policy.
View our trademark policy.
Subscribe for email updates about Let's Encrypt and other ISRG projects
(c) 2024 Internet Security Research Group
Our longstanding offering won’t fundamentally change next year, but we
are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
D <[email protected]> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <[email protected]> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>>> are going to introduce a new offering that's a big shift from anything >>>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <[email protected]> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but weSource:
are going to introduce a new offering that's a big shift from anything
we've done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
seems like everyone is using tls . . . is there anyone "not" using it?
D <[email protected]> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <[email protected]> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>>> are going to introduce a new offering that's a big shift from anything >>>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
frell [email protected] 45424f73fca08073b697ee69737da3dd 4:0.2c E 2024-12-10 2024-12-24[end quoted plain text]
gronk [email protected] e90a004308d8ceecb3e3f469d34ca2b9 4:0.2.6 M 2024-12-08 2024-12-22
lorem [email protected] f8ec1c45316ca426b2452b5a716d05d5 4:0.2.6 M 2024-12-07 2024-12-21
middleman [email protected] 6a1f4c71bafd3dac9fc2808c7011ca8d 4:0.2.6 M 2024-12-06 2024-12-20
milton [email protected] 41415e5f27dc27160d7d6f54238dd385 4:0.2.6 M 2024-12-10 2024-12-24
paranoyamn [email protected] 403977616c0c5497b1736efe10c91c03 4:0.2c E 2024-12-06 2024-12-20
shalo [email protected] a1b7038c154cc3e3cfa4bf2ee3c6e385 4:0.2.6 M 2024-12-05 2024-12-19
tncmm [email protected] 3d82ae32b0e692914fa84b8b994187c2 4:0.2c M 2024-12-04 2024-12-18
victor [email protected] 3be2e6fb18b7e5e00eb2a95deb9bc2c1 4:0.2c M 2024-12-08 2024-12-22
yamn [email protected] 0bb6ccac8db394739840bc586e8d425d 4:0.2.6 E 2024-12-08 2024-12-13
yamn2 [email protected] 6266507f5503fd11cbd22351f2b9c3b0 4:0.2.6 E 2024-12-09 2024-12-14
yamn3 [email protected] ef6361bd9b6489f5d2a4f3d542afbed1 4:0.2.6 E 2024-12-11 2024-12-16
yamn4 [email protected] 5d704a802745539fe58b80528fd7e596 4:0.2.6 M 2024-12-10 2024-12-24
I have been running 2-day TTL certs for some services I run. It is not
bad at all with ACME since things just renew in the background; and it
really helps cut down on the possbile impact of a compromised cert.
Without ACME though, no way it would be possible XD
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are
not using it.
But six day expiry dates, that just sounds insane.
On Thu, 12 Dec 2024 01:05:24 +0000, Broseki wrote:
I have been running 2-day TTL certs for some services I run. It is not
bad at all with ACME since things just renew in the background; and it
really helps cut down on the possbile impact of a compromised cert.
Without ACME though, no way it would be possible XD
If the Let’s Encrypt folks have no trouble with the server load, then I guess I have no objection either.
When I started using Let’s Encrypt, I found the default setting for Debian was to check for renewals twice a day. That shocked me a bit, but I assume they knew what they were doing.
That is an interesting point; I wonder how much load they are really
seeing; the certs I have set to 2 days are all for corporate internal
CAs using ACME not Let's Encrypt, my LE certs are still the default
(30 days now?). I also wonder if they have any sort of crypto
acceleration going on in the backend to make what I assume to be
massive amounts of requests flow smoothly.
On Dec 12, 2024 at 1:07:53 AM EST, "Lawrence D'Oliveiro"
<[email protected]d> wrote:
When I started using Let’s Encrypt, I found the default setting for
Debian was to check for renewals twice a day. That shocked me a bit,
but I assume they knew what they were doing.
That is an interesting point; I wonder how much load they are really
seeing; the certs I have set to 2 days are all for corporate internal
CAs using ACME not Let's Encrypt, my LE certs are still the default (30
days now?).
I also wonder if they have any sort of crypto acceleration
going on in the backend to make what I assume to be massive amounts of requests flow smoothly.
D <[email protected]> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <[email protected]> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>> are going to introduce a new offering that's a big shift from anything >>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
One of the problems with Let's Encrypt is
that you set up your server, you get a LE certificate, you set up a cron
job for renewal. And then 90 days later you find out that your cron job didn't work for $reasons and the cert expired.
It sounds quite handy to me. One of the problems with Let's Encrypt is that you set up your server, you get a LE certificate, you set up a cron job for renewal. And then 90 days later you find out that your cron job didn't work for $reasons and the cert expired. Making this timeout 6 days means that
you find this bug much quicker - if it's still working after a couple of weeks then things are good.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 741 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 108:34:00 |
| Calls: | 12,461 |
| Calls today: | 3 |
| Files: | 15,197 |
| Messages: | 6,538,104 |