Re: 6-day TLS certificates from Let's Encrypt

Rich <rich@example.invalid> writes:

Given Chrome's "insecure" branding in the URL bar from the "make
everything https" push some years back, there are far fewer who are
not using it.
>
But six day expiry dates, that just sounds insane.

I suspect six days is chosen to be one day shorter than the one-week
OCSP timeout they quote in their blog post about revocation[1]. So, they
can sunset OCSP support and at the same time improve revocation
performance and effectiveness (it fails open, so it doesn’t work against
a well-positioned attacker).

  [1] https://letsencrypt.org/2022/09/07/new-life-for-crls/

--
https://www.greenend.org.uk/rjk/