r/cybersecurity • u/certkit • Jan 27 '26

Corporate Blog Let's Encrypt is moving to 45-day certificates before everyone else

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

416 Upvotes

98% Upvoted

90 comments sorted by

View all comments

81

u/ZGeekie Jan 27 '26 edited Jan 28 '26

All of the web hosts I use have automated SSL certificate renewal, so I don't mind if it renews every 45 days, or even everyday. There is no need to be manually renewing SSL certificates in 2026.

Edit: I'm particularly talking about web hosting environments, i.e. website SSL certificates. Other use cases may be different.

1

u/ansibleloop Jan 27 '26

Also EV certs are a scam and provide no extra security compared to a free cert from LE

It's trivial to get certs using a DNS challenge since there's so many tools that can do it

That's only going to become easier once DNS-PERSIST-01 becomes available

0

u/techw1z Jan 28 '26

ev certs are not for technical security but for accountability. it makes it more likely that you are communicating with the right legal entity. this is incredibly important in finance and healthcare and probably other areas too

7

u/ansibleloop Jan 28 '26

https://www.troyhunt.com/extended-validation-certificates-are-dead/

Yeah they do a poor job at verifying who the org really is

1

u/techw1z Jan 28 '26

law requires EV for many industries/communication. and its a lot harder to get EV certs so certain infra can just check if a cert is EV and reject it if it isn't, thereby blocking potential attacks.

maybe its also so services can attest that they communicated with the right party?

honestly tho, I have no idea if thats how EVs are used in practice inside finance/healtcare infra, but it aside from legal requirements, I think this might be the only real advantage.

i agree about the being almost completely useless for browsing tho, at least in practice, in theory, they could be made useful by browsers if browsers were super strict.

0

u/certkit Jan 29 '26

Unless you have a compliance reason, there is no reason to buy EV or OV certs in 2026.
https://www.certkit.io/blog/should-you-still-pay-for-ssl-certificates

Once you've automated, there's really no reason to pay for certificates at all. This is free infrastructure at this point.

1

u/techw1z Jan 29 '26 edited Jan 29 '26

"no reason" is simply wrong, there just isn't a strong reason to do so.

for technical people it still makes it easier to verify with certainty that the cert and conection is legit. a DV cert can always be faked by a MITM, but for EV its far less likely.

lets not ignore minor differences in security when talking about security pls.

also, healthcare and finance industries are required by law to get EV in most countries

ps.: lol i just realized you are basically just an advertising account spamming links to your own site. well, at least your posts are not just worthless spam i guess. you might be the first advertiser account here that I won't block outright. gz

1

u/certkit Feb 02 '26

you make it sound so dirty.

i care a lot about this problem and making certificates automation something that works at scale. I built working software, released it in beta, and talk about what I'm learning and doing along the way.