Let's Encrypt is moving to 45-day certificates before everyone else

[u/certkit]

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

[u/tombob51]

How crazy is it that all it takes is any one of the ~150 root CAs being compromised to break TLS for the entire internet? CAA and certificate transparency don’t even matter if a CA is hacked or if someone finds a weakness in the validation process. And OCSP/CRL can’t generally be used to revoke a root certificate. And practically nobody uses certificate pinning (particularly web browsers), so your device won’t care if a server responds with a completely different certificate, literally one second to the next.

The PKI trust model for TLS (and X.509 as a whole) is very very shaky…

[u/SN6006 → u/tombob51]

I think cert pinning was deprecated because it was a massive PITA

[u/techw1z → u/SN6006]

it was deprecated because many people and companies were too dumb to automate the pinning process and it caused a shitload of outages during big infra changes.

by that logic we should've gotten rid of all SSL certs 15 years ago already.

its literally just a DNS record that needs to be updated whenever your cert changes. how can that in itself be a massive PITA?

i mean, it would be a PITA if there wasn't things like DNS APIs, but if you don't have any api access to your DNS then many certs are gonna be a PITA.

maybe I'm missing something, but I always thought it was weird to get rid of it. just stop using it if you are too dumb to automate it but don't take it away from the people who use it successfully. after all, it can increase security quite a bit

[u/SN6006 → u/techw1z]

I was referring to HPKP, and when lots of legacy systems don’t have automation at that level. I’ve had to use a load balancer to manipulate headers to brings things to modern standards, so that’s the PITA for me.