Our longstanding offering won't fundamentally change next year, but weSource:
are going to introduce a new offering that's a big shift from anything
we've done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
Thousands of people around the world make our work possible. Donate today. >...[end quoted plain text]
About Us
https://letsencrypt.org/about/
About Let's Encrypt
Let's Encrypt is a free, automated, and open certificate authority (CA), run for
the public's benefit. It is a service provided by the Internet Security Research
Group (ISRG).
We give people the digital certificates they need in order to enable HTTPS >(SSL/TLS) for websites, for free, in the most user-friendly way we can. We do this
because we want to create a more secure and privacy-respecting Web.
You can read about our most recent year in review by downloading our annual report.
The key principles behind Let's Encrypt are:
Free: Anyone who owns a domain name can use Let's Encrypt to obtain a trusted
certificate at zero cost.
Automatic: Software running on a web server can interact with Let's Encrypt to
painlessly obtain a certificate, securely configure it for use, and automatically
take care of renewal.
Secure: Let's Encrypt will serve as a platform for advancing TLS security best
practices, both on the CA side and by helping site operators properly secure
their servers.
Transparent: All certificates issued or revoked will be publicly recorded and
available for anyone to inspect.
Open: The automatic issuance and renewal protocol is published as an open
standard that others can adopt.
Cooperative: Much like the underlying Internet protocols themselves, Let's
Encrypt is a joint effort to benefit the community, beyond the control of any one
organization.
We have a page with more detailed information about how the Let's Encrypt CA works.
Support a more secure and privacy-respecting Web.
Donate
Let's Encrypt is a free, automated, and open certificate authority brought to you
by the nonprofit Internet Security Research Group (ISRG). Read all about our >nonprofit work this year in our 2024 Annual Report.
548 Market St, PMB 77519, San Francisco, CA 94104-5401, USA
Send all mail or inquiries to:
PO Box 18666, Minneapolis, MN 55418-0666, USA
GitHub
Mastodon
View our privacy policy.
View our trademark policy.
Subscribe for email updates about Let's Encrypt and other ISRG projects
(c) 2024 Internet Security Research Group
Our longstanding offering won’t fundamentally change next year, but we
are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
D <noreply@mixmin.net> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <smirzo@example.com> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>>> are going to introduce a new offering that's a big shift from anything >>>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <smirzo@example.com> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but weSource:
are going to introduce a new offering that's a big shift from anything
we've done before - short-lived certificates. Specifically,
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
seems like everyone is using tls . . . is there anyone "not" using it?
D <noreply@mixmin.net> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <smirzo@example.com> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>>> are going to introduce a new offering that's a big shift from anything >>>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
frell nyam@remailer.frell.eu.org 45424f73fca08073b697ee69737da3dd 4:0.2c E 2024-12-10 2024-12-24[end quoted plain text]
gronk yamn@gronk.ch e90a004308d8ceecb3e3f469d34ca2b9 4:0.2.6 M 2024-12-08 2024-12-22
lorem yamn@eocto.net f8ec1c45316ca426b2452b5a716d05d5 4:0.2.6 M 2024-12-07 2024-12-21
middleman yamn@middleman.remailer.online 6a1f4c71bafd3dac9fc2808c7011ca8d 4:0.2.6 M 2024-12-06 2024-12-20
milton yamn@milton.redmv.net 41415e5f27dc27160d7d6f54238dd385 4:0.2.6 M 2024-12-10 2024-12-24
paranoyamn yamn@yamn.paranoici.org 403977616c0c5497b1736efe10c91c03 4:0.2c E 2024-12-06 2024-12-20
shalo yamn@shalo.ca a1b7038c154cc3e3cfa4bf2ee3c6e385 4:0.2.6 M 2024-12-05 2024-12-19
tncmm yamn@tnetconsulting.net 3d82ae32b0e692914fa84b8b994187c2 4:0.2c M 2024-12-04 2024-12-18
victor yamn@virebent.art 3be2e6fb18b7e5e00eb2a95deb9bc2c1 4:0.2c M 2024-12-08 2024-12-22
yamn yamn@mixmin.net 0bb6ccac8db394739840bc586e8d425d 4:0.2.6 E 2024-12-08 2024-12-13
yamn2 yamn2@mixmin.net 6266507f5503fd11cbd22351f2b9c3b0 4:0.2.6 E 2024-12-09 2024-12-14
yamn3 yamn3@mixmin.net ef6361bd9b6489f5d2a4f3d542afbed1 4:0.2.6 E 2024-12-11 2024-12-16
yamn4 yamn4@mixmin.net 5d704a802745539fe58b80528fd7e596 4:0.2.6 M 2024-12-10 2024-12-24
I have been running 2-day TTL certs for some services I run. It is not
bad at all with ACME since things just renew in the background; and it
really helps cut down on the possbile impact of a compromised cert.
Without ACME though, no way it would be possible XD
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are
not using it.
But six day expiry dates, that just sounds insane.
On Thu, 12 Dec 2024 01:05:24 +0000, Broseki wrote:
I have been running 2-day TTL certs for some services I run. It is not
bad at all with ACME since things just renew in the background; and it
really helps cut down on the possbile impact of a compromised cert.
Without ACME though, no way it would be possible XD
If the Let’s Encrypt folks have no trouble with the server load, then I guess I have no objection either.
When I started using Let’s Encrypt, I found the default setting for Debian was to check for renewals twice a day. That shocked me a bit, but I assume they knew what they were doing.
That is an interesting point; I wonder how much load they are really
seeing; the certs I have set to 2 days are all for corporate internal
CAs using ACME not Let's Encrypt, my LE certs are still the default
(30 days now?). I also wonder if they have any sort of crypto
acceleration going on in the backend to make what I assume to be
massive amounts of requests flow smoothly.
On Dec 12, 2024 at 1:07:53 AM EST, "Lawrence D'Oliveiro"
<ldo@nz.invalid> wrote:
When I started using Let’s Encrypt, I found the default setting for
Debian was to check for renewals twice a day. That shocked me a bit,
but I assume they knew what they were doing.
That is an interesting point; I wonder how much load they are really
seeing; the certs I have set to 2 days are all for corporate internal
CAs using ACME not Let's Encrypt, my LE certs are still the default (30
days now?).
I also wonder if they have any sort of crypto acceleration
going on in the backend to make what I assume to be massive amounts of requests flow smoothly.
D <noreply@mixmin.net> wrote:
On Wed, 11 Dec 2024 20:27:37 -0300, Salvador Mirzo <smirzo@example.com> wrote:
Let's Encrypt is planning a 6-day TLS certificate for next year.
Our longstanding offering won't fundamentally change next year, but we >>> are going to introduce a new offering that's a big shift from anything >>> we've done before - short-lived certificates. Specifically,Source:
certificates with a lifetime of six days. This is a big upgrade for
the security of the TLS ecosystem because it minimizes exposure time
during a key compromise event.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/
seems like everyone is using tls . . . is there anyone "not" using it?
Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are not
using it.
But six day expiry dates, that just sounds insane.
One of the problems with Let's Encrypt is
that you set up your server, you get a LE certificate, you set up a cron
job for renewal. And then 90 days later you find out that your cron job didn't work for $reasons and the cert expired.
It sounds quite handy to me. One of the problems with Let's Encrypt is that you set up your server, you get a LE certificate, you set up a cron job for renewal. And then 90 days later you find out that your cron job didn't work for $reasons and the cert expired. Making this timeout 6 days means that
you find this bug much quicker - if it's still working after a couple of weeks then things are good.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 481 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 26:55:40 |
| Calls: | 9,543 |
| Calls today: | 3 |
| Files: | 13,656 |
| Messages: | 6,140,474 |