logoalt Hacker News

nottorp • today at 1:19 PM • 2 replies • view on HN

> duration of 1 year or longer

Let's Encrypt is bringing the duration of certs down not up. I believe their goal is 30 minutes validity.


Replies

throw0101c • today at 1:40 PM

> Let's Encrypt is bringing the duration of certs down not up. I believe their goal is 30 minutes validity.

This is mandated by the CA/Browser Forum, which, as the name implies, is related to browsers. It says nothing about e-mail clients. In its Extended Key Usage filed (RFC 5280 § 4.2.1.12) a certificate could not have server or client authentication, but have email protection as an allowed use.

Edit: there is an RFC for "Extensions to Automatic Certificate Management Environment for End-User S/MIME Certificates"

* https://datatracker.ietf.org/doc/html/rfc8823

FiloSottile • today at 2:42 PM

As far as I know 30 minutes validity is no one's goal, even long term.

The most aggressive plans (not Let's Encrypt's specifically) target 7 day validities.