Selfhosted

Will we need to log in every morning and expect to refresh every damn site cert we connect to soon?

Automate your certificate renewals. You should be automating updates for security anyway.

So what's the floor here realistically, are they going to lower it to 30 days, then 14, then 2, then 1?

LE is beta-testing a 7-day validity, IIRC.

Will we need to log in every morning and expect to refresh every damn site cert we connect to soon?

No, those are expected or even required to be automated.

Partition the internet... Like during the Morris worm of '88, where they had to pull off regional networks to prevent the machines from being reinfected?

The good old days were, maybe, not that good. :)

The current plan is for the floor to be 47 days. https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days, and this is not until 2029 in order to give people sufficient time to adjust. Of course, individual certificate authorities can choose to have lower validity periods than 47 days if they want to.

Essentially, the goal is for everyone to automatically renew the certificates once per month, but include some buffer time in case of issues.

Ours is automated, but we incur downtime on the renewal because our org forbids plain http so we have to do TLS-ALPN-01. It is a short downtime. I wish let's encrypt would just allow http challenges over https while skipping the cert validation. It's nuts that we have to meaningfully reply over 80...

Though I also think it's nuts that we aren't allowed to even send a redirect over 80...

I've got it setup automated on all my external domains, but trying to automate it on my internal-only domain is rather tedious since not only do I NOT want to open a port for it to confirm, but I have 2 other devices/services on the network not behind my primary reverse proxy that share the same cert.

What In need to do is setup my own custom cron that hits the hosting provider to update the DNS txt entries. Then I need to have it write and restart the services that use the cert. I've tried to automate this once before and it did not go so smoothly so I've been hesitant on wasting time to try it again... But maybe it's time to.

What would be ideal is if I could allow it to be automated just by getting a one time dns approval and storing a local private/public key to prove to them that I'm the owner of the domain or something. Not aware of this being possible though.

Terminology: revoked means the issuer of the certificate has decided that the certificate should not be trusted anymore even though it is still valid.

If a attacker gets access to a certificates key, they can impersonate the server until the validity period of the cert runs out or it is revoked by the CA. However ... revocation doesn't work. The revocation lists arent checked by most clients so a stolen cert will be accepted potentially for a very long time.

The second argument for shorter certs is adoption of new technology so certs with bad cryptographic algorithms are circled out quicker.

And third argument is: if the validity is so short you don't want to change the certs manually and automate the process, you can never forget and let your certs expire.

We will probably get to a point of single day certs or even one cert per connection eventually and every step will be saver than before (until we get to single use certs which will probably fuck over privacy)

No, but I have a link showing how ISPs and CAs colluded to do a MITM https://notes.valdikss.org.ru/jabber.ru-mitm/

Shorter cert lifespan would not prevent this.

The point is, if the certificate gets stolen, there's no GOOD mechanism for marking it bad.

If your password gets stolen, only two entities need to be told it's invalid. You and the website the password is for.

If an SSL certificate is stolen, everyone who would potentially use the website need to know, and they need to know before they try to contact the website. SSL certificate revocation is a very difficult communication problem, and it's mostly ignored by browsers because of the major performance issues it brings having to double check SSL certs with a third party.

Short lifespans are also great when domains change their owner. With a 3 year lifespan, the old owner could possibly still read traffic for a few more years.

When the lifespan ist just 30-90 days, that risk is significatly reduced.

Are you not using LE certbot to handle renewals? I can't even imagine doing this manually.

Might as well adjust the setting now. I had that same feeling for something they changed several years ago and never got around to changing it til all my stuff went down lol.

Check your autorenewal failure alerts go somewhere you'll react to.

clearly the most secure option is to have certificates that are only valid for 30 seconds at a time

Wait, how's this worse? This makes the Internet safer by reducing the window a leaked key can do harm.

You can absolutely run your own CA and even get your friends to trust it.

Like what?

SSL is so simple and automatic with certbot.

Then there's CORS if you really need to load resources from other sites, but you won't need that for small sites.

Making the backend is easier than ever. It's much harder to make security mistakes nowadays.

And if you don't know what you're doing, just ask an LLM if you made any fuckups..