Hacker News Reader

Comment by FreeHugs | Hacker News Reader

One thing I don't understand about Let's Encrypt:

Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?

The security aspects have been covered but there is another advantage. When people get a 2 year certificate they very often forget to renew it until their website becomes broken. With a 90 day expiry you are pretty much forced to add a task to crontab that renews automatically.

https://letsencrypt.org/2015/11/09/why-90-days.html

> They limit damage from key compromise and mis-issuance. Stolen keys and mis-issued certificates are valid for a shorter period of time.

> They encourage automation, which is absolutely essential for ease-of-use. If we’re going to move the entire Web to HTTPS, we can’t continue to expect system administrators to manually handle renewals. Once issuance and renewal are automated, shorter lifetimes won’t be any less convenient than longer ones.

Nobody actually checks certificate revocation lists so a compromised cert that’s valid for 5 years can be used maliciously for the full duration.

90 days was what they decided the best compromise for usability and security.

Taken to the extreme ‘immediate’ certificate expiration starts to look a lot like Kerberos which is maybe what we always wanted.

If you loose control of the private key it limits the time an attacker could use it.

Reply on news.ycombinator.com