Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscribers simply need to select the ‘shortlived’ certificate profile in their ACME client.
Short-lived certificates improve security by requiring more frequent validation and reducing reliance on unreliable revocation mechanisms. If a certificate’s private key is exposed or compromised, revocation has historically been the way to mitigate damage prior to the certificate’s expiration. Unfortunately, revocation is an unreliable system so many relying parties continue to be vulnerable until the certificate expires, a period as long as 90 days. With short-lived certificates that vulnerability window is greatly reduced.

Hacker News is a community-driven platform for sharing and discussing technology news, startups, and programming-related topics. Through user submissions and comments, Hacker News offers insights into emerging technology trends, industry developments, and entrepreneurial ventures. Readers can participate in discussions, share their insights, and stay informed about the latest advancements in technology and innovation.

Hacker News

Let's Encrypt now offers 6-day (160-hour) short-lived certificates and IP address certificates as generally available features. Short-lived certificates enhance security by reducing the vulnerability window from 90 days to just over 6 days when private keys are compromised, addressing the unreliability of traditional revocation mechanisms. These certificates are opt-in and require selecting the 'shortlived' profile in ACME clients. IP address certificates support both IPv4 and IPv6 authentication and must use the short-lived format due to the transient nature of IP addresses. Standard certificate lifetimes will transition from 90 to 45 days over the coming years.

6-day and IP Address Certificates are Generally Available