I understand their reasoning behind this, but I am not sure, this is such a good idea. Imagine Letsencrypt having technical issues or getting DDoS'd. If the certificates are valid for 90 days and are typically renewed well in advance, no real problem arises, but with only 6 days in total, you really can't renew them all that much in advance, so this risk of lots of sites having expired certificates in such a situation appears quite large to me.

When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn't the biggest issue with server certificates.

Don’t certs just create an ephemeral key pair that disappears after the session anyhow? What does cert validity period have to do with “This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.”

I mean, it’s LE so I’m sure they know what their talking about. But…?

It's kind of in line with their plan to get rid of OCSP: short certificate lifetimes keep CRLs short, so I get where they're coming from (I think).

90 days of validity, which was once a short lifetime. Currently, Google is planning to enforce this as the maximum validity duration in their browser, and I'm sure Mozilla will follow, but it wouldn't matter if they didn't because no provider can afford to not support chromium based browsers.

I was expecting that they reduce the maximum situation to e.g. 30 days, but I guess they want to make the stricter rules optional first to make sure there are no issues.

Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).

I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.

Digicert, Sectigo, Globalsign: hold my beer, 1 day certificate, even better: on the fly certificate per client 😂

I wonder how short this could conceivably go…