Final Unicourse'tan Çalış, Yüksek Notu Garantile!
%25 İndirim Kodu: FRM25
Yükleniyor...
Dersi İzle
GÖRÜNTÜLEYENLER
+36
Premium Özellik
Bu konuyu kimlerin görüntülediğini görmek için Premium üyelik gerekir.
Premium'a Geç
Vizesine Unicourse'tan Çalış, Yüksek Notu Garantile!
Dersi İzle
SPONSORLU ETKİNLİK
Fikrini Gerçeğe Dönüştür
Projeni dünyaya göstermek için sahne hazır. Red Bull Basement başvuruları açık.
Başvurunu YapAnyone using 6-day certs yet?
-
Since the beginning of this year, Let's Encrypt rolled out a new
shortlivedprofile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?
As for me I've set up
lego-acmewithprofile: "shortlived"on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice. -
Since the beginning of this year, Let's Encrypt rolled out a new
shortlivedprofile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?
As for me I've set up
lego-acmewithprofile: "shortlived"on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.I'm happy with 90 day certs for homelab stuff: I'm not worried about anyone MITMing my network. I figure the short lived certs are more important for people who provide services with a significant external user-base, or who process sensitive transactions.
I have my certbot set to check every 12 hours and renew at 60 days. Renewing every 3 days would be 20x more load on Let's Encrypt systems, and that feels like abuse of a free service for my use case.
-
Since the beginning of this year, Let's Encrypt rolled out a new
shortlivedprofile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?
As for me I've set up
lego-acmewithprofile: "shortlived"on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.Honest, non-techie question: How is it an advantage? Given modern crypto isnt it more likely that a mitm didn't crack the crypto but instead got somehow else in the middle and just can "ignore" certs renewals?
-
Since the beginning of this year, Let's Encrypt rolled out a new
shortlivedprofile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).Yet, I haven't seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?
As for me I've set up
lego-acmewithprofile: "shortlived"on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It's been pretty much a set-and-forget experience, although some more monitoring would be nice.I migrated from vanilla Nginx Proxy Manager to NPMplus (because of CrowdSec), and it defaults to short-lived certificates. Other than temporarily making my Uptime Kuma SSL monitors completely freak out because my certificates "were too close to expiration", everything still works exactly the same.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Kayıt Ol Giriş
