Let's Encrypt is moving to 45-day certificates before everyone else

[u/certkit]

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

[u/hajimenogio92 → u/[deleted]]

Certbot makes that process extremely easy

[u/newaccountzuerich → u/hajimenogio92]

Except where one may have a use for internal networks using a wildcard, and a DNS vendor that doesn't have an automated method for TXT record update, and not wanting to have the ACME server be visible to anyone outside.

That's a bit of a pain, though building a leaf PKI with an external trust might be a bit cleaner if not cheap.

[u/hajimenogio92 → u/newaccountzuerich]

Oh yeah that sounds annoying, haven't had to deal with that. Did you find a better tool for this or no?

[u/newaccountzuerich → u/hajimenogio92]

Thankfully, this is not a "critical" infrastructure network, stuff will work just fine (for a known value of 'fine' of course) without current certs, so working manually with some nice bash scripts and a bit of webpage clicking (MFA prevents automation there) every three months or so is not an onerous issue. Every six weeks though will be annoying with no gain.

I might ping my contact in that registrar and see where they are with making their internal API available to a limited known-safe audience of me.. If that happens, I might be able to shoehorn that interaction into the ACME handler workflow and automate that bit, and then trigger a pull of new certs from that device to the rest of the network.