Since the beginning of this year, Let’s Encrypt rolled out a new shortlived profile for certificates that make them valid for only 160 hours. The intention, as they say, is to encourage automation and reduce the window of certificate compromise (because revocation is somewhat a flakey thing).

Yet, I haven’t seen a lot of news about it since then. Hence the question: is this shorter cert thingy something you considered and deployed for your homelab?

As for me I’ve set up lego-acme with profile: "shortlived" on my rig. Lego runs on a bihourly cronjob, but only renews when a cert has >=3 days to expiry. It’s been pretty much a set-and-forget experience, although some more monitoring would be nice.

  • tburkhol@slrpnk.netEnglish
    1·
    13 days ago

    I’m happy with 90 day certs for homelab stuff: I’m not worried about anyone MITMing my network. I figure the short lived certs are more important for people who provide services with a significant external user-base, or who process sensitive transactions.

    I have my certbot set to check every 12 hours and renew at 60 days. Renewing every 3 days would be 20x more load on Let’s Encrypt systems, and that feels like abuse of a free service for my use case.

  • chunkystyles@sopuli.xyzEnglish
    1·
    13 days ago

    Everyone in here taking about an the automations they’ve done for certs and I just use Caddy. It handles all that for me.

    • dan@upvote.auEnglish
      1·
      13 days ago

      Caddy is a good piece of software.

      I’ve been using Nginx for 20 years and don’t really have a reason to switch, so I’m still using it. I use certbot, so it’s just one command to create the certificate initially, and then it auto-renews automatically via a systemd timer.

  • Auli@lemmy.caEnglish
    1·
    13 days ago

    Yes, with Caddy and haven’t noticed a thing, and had no complaints. So it has been perfectly fine and it is all automated.

  • Harold@feddit.nlEnglish
    0·
    13 days ago

    Thank you for sharing. I had missed the announcement, so pleased to know the option is available.

    I have fully automated the creation and renewal of my certs and have just short of 50 certs that I manage in total. Every single one automated using NixOS / ACME / lego.

    Technically I could easily implement this, just have to switch my config.

    Honest question, are there any particular security benefits to this (especially for a home lab)?

    I can understand the short lived time span further reduces risk of compromise, yet the existing time span is already “much shorter than traditional certificates”. Does it have a substantial impact on our security posture?

    • plateee@piefed.socialEnglish
      1·
      13 days ago

      At work, I used ssh-signed certificates for Linux server access - those certs are only valid for about 15 minutes.

      The whole idea of shorter lifetime certificates is to address if a certificate is compromised. (Especially for client certificates which, iirc, Let’s Encrypt no longer offers).

      For a home lab? With no externally accessible services? Short-lived certs aren’t really a big deal. Nobody is going to be hacking your homelab, stealing your private keys, poisoning your internal DNS, and pointing you to a different, malicious service.

      • tal@lemmy.todayEnglish
        1·
        13 days ago

        If you’re a developer for an important open source project, they might.

        Attacking the xz project wasn’t done because the attacker cared about anything that the xz maintainer had. It was because he was trusted and the software he maintained had been given a fair bit of trust by certain maintainers and could be compromised and used as a vector into other systems that indirectly relied on that open-source project.