CRL are a failure, OCSP can't scale, so to get some assurance that if the private key was compromised somewhat recently, it's either mandating OCSP stapling or shorter lived certs...
Why do you hate the short lifetimes?
Why do you hate the short lifetimes?
Because they require more frequent maintenance. That has to happen either manually or through automation. LE seems to think that automation means that short lifetimes aren't painful, but I disagree -- if for no other reason than that there are plenty of places where automation is not feasible.
From their FAQ (https://letsencrypt.org/docs/faq/):
What is the lifetime for Let’s Encrypt certificates? For how long are they valid?
Our certificates are valid for 90 days. You can read about why here.
There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.
This feels like software that deletes its own config file every three months, just to make you write a script that regenerates the config. Make-work. It would be great to have a button “I understand the risks, give me a 5 year certificate.”
I think most people will find short lived certificates more convenient than mandatory OCSP stapling.