Security

5068 readers

1 users here now

Confidentiality Integrity Availability

founded 5 years ago

MODERATORS

[email protected]

Short-Lived Certificates Coming to Let’s Encrypt (letsencrypt.org)

submitted 6 days ago by atzanteol to c/[email protected]

2 comments fedilink hide all child comments

Our longstanding offering won’t fundamentally change next year, but we are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 6 days ago* (last edited 6 days ago) (1 children)

So is this specifically for less trusted transition certs, to provide encryption when the old cert is known to be compromised and the new cert isn’t fully deployed yet?

[–] [email protected] 4 points 6 days ago

Interested amateur disclaimer!

Fast rotating certificates always more secure because the timeframe between beach discovery and system inherent revoke is shorter.

How big the impact in terms of real life is I can't even guess because of the (from my perspective) weird circumstances they must happen to depend on the certificate lifetime itself.

I guess it's just one of these "every but helps" factors more than specific use cases.