Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Documentation about certificate lifetimes and rationale#1993

Open
bdaehlie wants to merge 1 commit into
main from
doc-cert-lifetimes
Open

Documentation about certificate lifetimes and rationale #1993
bdaehlie wants to merge 1 commit into
main from
doc-cert-lifetimes

Conversation

@bdaehlie

@bdaehlie bdaehlie commented Aug 3, 2025

Copy link
Copy Markdown
Contributor

Resolves #1214

bdaehlie commented Aug 3, 2025

Copy link
Copy Markdown
Contributor Author

Asking for content review first, once we're happy with that I'll commit all the other language files for this. That'll keep the diff UI here cleaner during content review.

@bdaehlie bdaehlie marked this pull request as ready for review August 3, 2025 04:53

@aarongable aarongable left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Content generally LGTM, especially the justifications around why we offer the lifetimes that we do. Some of the more factual information seems redundant with what's already explained on the Profiles page (https://letsencrypt.org/docs/profiles/), so we should at the very least link to that, if not replace some of this language with just a link to that to prevent duplication.

schoen commented Aug 7, 2025

Copy link
Copy Markdown
Collaborator

Another benefit is that shorter lifetimes limit the damage from properly-issued certificates whose contents become incorrect during their lifetimes. For DV, that's largely the case of "control of the underlying subject identifier changed". For other forms of certificates that Let's Encrypt doesn't issue it could be that some other detail about the subject changed.

A real-world offline example for me is that I had an internship in college and was issued an employee ID with no expiration date. As a result, I used my (unexpired!) employee ID a couple of times after my internship had ended to visit the employer's campus again and enjoy the nice view there. The ID document was no longer accurate, in the sense that the employee relationship it described no longer existed. I didn't do anything harmful or malicious to my former employer or its premises, but their security policy would probably have preferred that former interns be more readily distinguished from current interns!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aarongable aarongable aarongable left review comments
@jsha jsha Awaiting requested review from jsha

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add documentation about certificate lifetime choices and future plans

AltStyle によって変換されたページ (->オリジナル) /