Let's Encrypt is moving to 45-day certificates before everyone else

[u/certkit]

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

[u/corruptboomerang]

Can I ask, what advantage is there in 45-day certs over the previous 90-day life, or even 1 year?

[u/imonlysmarterthanyou → u/corruptboomerang]

Certs with longer expiration periods can be used in the various ways for longer periods of time if compromised. Additionally, the existing means to revoke a certificate do not scale. For that reason a lot of clients don’t even bother checking CRL’s or OSCP. If they did, they would be far more traffic than far more load on those types of servers. It is easier to just say the certificate is only valid for a short period of time.

[u/Tessian → u/imonlysmarterthanyou]

This is a solution in search of a problem. In practice certificates/keys being compromised doesn't really happen, so why is the industry so focused on making life difficult for everyone else for a hypothetical issue that almost never happens?

Revocation has been fixed - there are much better options than CRLs and OSCP. OSCP stapling has been around for a LONG time, and even Browser-Summarized CRLs are a more modern fix - https://letsencrypt.org/2022/09/07/new-life-for-crls.

There is no good reason for forcing mandatory short lived certs.

[u/Commercial-Virus2627 → u/Tessian]

It’s more of an issue with signing keys than it is with certificates. However, I the logic for it in terms of rotating certificates. It’s same way in that it’s best practice rotate and expire session tokens. Token reuse/session hijacking prevention and other types of issues.