Hacker News Reader

Comment by mholt | Hacker News Reader

This is... fine... but I wish we were pushing for shorter cert lifetimes rather than expanding infrastructure to support longer cert lifetimes and to band-aid revocation, which is broken anyway.

goes to make Caddy and CertMagic ACME clients even more complicated

View on HN

The blog post mentions how this does help with the push for shorter cert lifetimes.

> ARI can be used to set subscribers up for success in terms of ideal renewal times in the event that Let’s Encrypt offers even shorter-lived certificates in the future.

That's not the same. That's saying "We issued a 90-day cert but now want it to be less than that." What I'm saying is "Issue 7 day certs."

I hope we can use ARI to trigger renewals as-if we had short lived certs, along that pathway. From a scale-up perspective of running the CA, that’s very useful.

Much of Let’s Encrypts engineering time has been spent on revocation infrastructure, and I don’t like it. I’d much rather issue 2.5 day certs than 2.5 day OCSP responses we need to serve with high availability.

I’m hoping in the near future we see a CA/B ballot and and associated root program changes allowing us to not run OCSP infrastructure for short-lived certs.

That’s the kick needed to support short-lived certs. Of course Caddy is one of the best implementations of TLS and certificate handling and is already ready for that world, but many other systems are going to have a much worse time. That’s a big concern, and it’ll take everyone a while to switch to Caddy to fix their busted manual processes :)

(I’m an employee of Let’s Encrypt but these opinions are my own)

Thanks for the feedback. Congrats on deploying a new feature to production!

I'll see about adding ARI to Caddy in the hopes that it will accelerate the transition to shorter-lived certs.

I don't see a standard 90 day certificate in the phrase "even shorter-lived certificates." If it was a 90 day certificate, it wouldn't be shorter-lived. It seems to me Let's Encrypt was referring to the possibility of exactly what you asked for, separately from revocation.

Reply on news.ycombinator.com