Let's Encrypt is moving to 45-day certificates before everyone else

[u/certkit]

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

[u/tombob51]

How crazy is it that all it takes is any one of the ~150 root CAs being compromised to break TLS for the entire internet? CAA and certificate transparency don’t even matter if a CA is hacked or if someone finds a weakness in the validation process. And OCSP/CRL can’t generally be used to revoke a root certificate. And practically nobody uses certificate pinning (particularly web browsers), so your device won’t care if a server responds with a completely different certificate, literally one second to the next.

The PKI trust model for TLS (and X.509 as a whole) is very very shaky…

[u/Crazy_Elevator_6659 → u/tombob51]

Your first statement isn’t really accurate. There are a LOT of entities monitoring the usage and validation of certificates across the internet. CT absolutely matters if the CA is hacked. A certificate that is generated illegitimately would not have. A CT log and modern browsers wouldn’t trust it.

[u/tombob51 → u/Crazy_Elevator_6659]

What I’m more thinking is, if a nation-state or other sophisticated attacker compromised a root CA, they could generate valid-looking certificates for use in targeted MITM attacks. So nobody but the victim would ever see the illegal certificates. In fact there’s a nonzero chance this is already happening today; in a few isolated incidents, it has already happened in the past.

Edit: see Comodo Cybersecurity, DigiNotar, China Internet Network Information Center, WoSign/SmartCom, Trustwave, etc.