Comment on Anyone using 6-day certs yet?
Ooops@feddit.org 3 days ago
Certbot came with a systemd timer running twice a day (0, 12 +12h random) that only renews –iirc– when the certificate has 30 days or less to live. Also I looked it up and my Version 6.7 Cerrtbot neither mentions the option with the --help option, nor in the manual (where there is just one instance of “profiles exist, no other details given”).
So they probably need another way than a random blog post when they want users to use (or even just know about) that option…
pdl@social.tchncs.de 2 days ago
@Ooops @stratself Certbot renews a certificate when the remaining lifetime is lower than 30 %. If you change the profile from tlsserver (90 days) to shortlived (6 days), you do not need to adjust the renewal interval manually, because it is relative to the cert livetime.
I think it is not Letsencrypt's part to document how to use the different profiles with certbot. It should be explained in the documentation of the ACME client (certbot and others).
I know that I could easily change my config. My point is that a) they are failing to advertise this and b) I don’t see any reason to do it. I understand the arguments about security benefits of shorter certificates on their side and iirc they are already planning to change it from 3 months to 1.5 months in the future. But in what scenario do I benefit from a short-term certificate as long as the regular ones are still available anyway?
pdl@social.tchncs.de 2 days ago
@Ooops I do not understand what you mean with "they are failing to advertise this". Letsencrypt has announced in in their blog:
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs
https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued
The profiles are documented:
https://letsencrypt.org/docs/profiles/
It is your deciscion what profile to use. If you use the shortlived profile and your key is compromised, you benefit from the short lifetime. This benefit you have regardless of the availability of the 90 day certs.
Maybe I’m just too stupid to understand how those certificates work.
But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?
Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.