Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027

Let's Encrypt is continuing a push toward tighter security by reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting February 10, 2027. For administrators already implementing modern ACME clients that support ARI (ACME Renewal Information), the change should be seamless. For those still relying on hardcoded renewal schedules or manual processes, February will be the deadline to update before certificates start expiring unexpectedly.

Starting on October 14, Let's Encrypt will begin testing the 64-day certificates, and interested users can opt in to test their setups before production goes live.

Prior to Let's Encrypt's launch in early 2016, certificates were often issued for as long as one to three years. The service started with 90-day certificates to force renewal automation that didn't previously exist. Shorter certificate validity periods limited vulnerabilities from private key thefts and encouraged accelerated HTTPS adoption across the web.

Read full article

Comments

Let's Encrypt - Les sanctions US s'invitent dans le contrat

Si vous êtes développeur en Iran, à Cuba ou en Corée du Nord, vous venez officiellement de perdre l'accès à Let's Encrypt !

En effet, la version 1.7 du Subscriber Agreement publiée par l'ISRG (Internet Security Research Group), l'organisation derrière le service, est malheureusement entrée en vigueur le 4 juin dernier. Et sur les 8 pages du document, il n'y a qu'un seul ajout, mais il pèse trèèès lourd : section 3.1, un nouveau bullet point oblige maintenant chaque utilisateur à garantir qu'il "n'est pas localisé, organisé sous les lois de, ou résident dans un pays cible de sanctions américaines complètes".

En pratique, la liste OFAC des juridictions sous sanctions globales actuelles couvre Cuba, l'Iran, la Corée du Nord, et les zones occupées de Crimée, Donetsk et Lougansk (la Syrie en a été retirée fin 2025 ce qui montre bien à quel point ce périmètre peut évoluer rapidement).

Et le couperet ne tombe pas que sur des États-paria abstraits puisque ONG d'aide humanitaire, journalistes, universités, et tout le monde qui travaille ou vit dans ces zones perd le service. Du coup, pour récupérer un certificat HTTPS gratuit, vous devez maintenant signer une clause d'embargo. Plusieurs utilisateurs rapportent également que des certificats de sites russes auraient déjà été révoqués au cours des derniers mois, sans préavis officiel de l'ISRG...

Le piège, c'est la section 2.2 du contrat, intacte depuis longtemps mais qui prend un sens tout neuf : l'agrément reste en vigueur tant que vous possédez un seul certificat valide. Cela veut dire qu'une violation potentielle sur UN certificat peut donc, en théorie, déclencher une révocation en cascade de TOUS les autres, un peu comme un crédit immobilier où une mensualité ratée rendrait tout le contrat caduque...

Je vous laisse imaginer la tronche d'un hébergeur qui gère mille sites le jour où ça tombe et qui crée des certificats Let's Encrypt pour ses clients... La section 4.2 énumère onze motifs de révocation activables "à la seule discrétion" de l'ISRG, dont la violation de l'agrément et un joli fourre-tout "d'autres motifs raisonnables et légaux".

Notez que l'ISRG est domiciliée à San Jose, en Californie et que tous les CA américains (DigiCert, Sectigo, GlobalSign US) sont déjà soumis aux mêmes obligations OFAC depuis toujours, donc c'est pas vraiment non plus une surprise... Mais ça tombe toujours mal ce genre de conneries.

Maintenant, côté alternatives, si vous voulez sortir de la juridiction US, y'a pas grand chose... Je me souviens de ZeroSSL qui ressemblait à une option européenne mais qui a été racheté début 2024 par HID Global (filiale du suédois Assa Abloy, basée au Texas... donc aux Etats-Unis), donc soumis aux mêmes obligations OFAC à terme. Après vous avez peut-être des services à me recommander ? Sinon il faudra passer par des certificats payants.

Bref, le HTTPS gratuit a toujours eu un drapeau, mais on faisait juste semblant de l'oublier...

Renewing Let's Encrypt Certificates with NGINX Unit

Recently, I moved the DjangoTricks website and started PyBazaar on servers with Nginx Unit. One thing that was left undone was SSL certificate renewals. Let's Encrypt has special certbot parameters for renewing certificates for websites on Apache or Nginx servers, but they don't work out of the box with the Nginx Unit. In this blog post, I will tell you how to do that.

The certificate bundle

Nginx Unit doesn't use the fullchain.pem and privkey.pem generated by certbot directly from the location where they were generated. Instead, one has to create a bundle (like bundle1.pem) by concatenating them and then uploading it to the Nginx Unit configuration endpoint.

The bash script

For that, I created a bash script:

#!/usr/bin/env bash
SECONDS=0
CRON_LOG_FILE=/var/webapps/pybazaar/logs/renew_certificate.log

echo "=== Renewing Letsencrypt Certificate ===" > ${CRON_LOG_FILE}
date >> ${CRON_LOG_FILE}

echo "Renewing certificate..." >> ${CRON_LOG_FILE}
certbot --renew-by-default certonly -n --webroot -w /var/www/letsencrypt/ -m hello@pybazaar.com --agree-tos --no-verify-ssl -d pybazaar.com -d www.pybazaar.com

echo "Creating bundle..." >> ${CRON_LOG_FILE}
cat /etc/letsencrypt/live/pybazaar.com/fullchain.pem /etc/letsencrypt/live/pybazaar.com/privkey.pem > /var/webapps/pybazaar/unit-config/bundle1.pem

echo "Temporarily switching the Unit configuration to a dummy one..." >> ${CRON_LOG_FILE}
curl -X PUT --data-binary @/var/webapps/pybazaar/unit-config/unit-config-pre.json --unix-socket /var/run/control.unit.sock http://localhost/config

echo "Deleting old certificate from Nginx Unit..." >> ${CRON_LOG_FILE}
curl -X DELETE --unix-socket /var/run/control.unit.sock http://localhost/certificates/certbot1

echo "Installing new certificate to Nginx Unit..." >> ${CRON_LOG_FILE}
curl -X PUT --data-binary @/var/webapps/pybazaar/unit-config/bundle1.pem --unix-socket /var/run/control.unit.sock http://localhost/certificates/certbot1

echo "Switching the Unit configuration to the correct one..." >> ${CRON_LOG_FILE}
curl -X PUT --data-binary @/var/webapps/pybazaar/unit-config/unit-config.json --unix-socket /var/run/control.unit.sock http://localhost/config

echo "Restarting Unit..." >> ${CRON_LOG_FILE}
service unit restart

echo "Finished." >> ${CRON_LOG_FILE}
duration=$SECONDS
echo "$(($duration / 60)) minutes and $(($duration % 60)) seconds elapsed." >> ${CRON_LOG_FILE}

Once you have adapted the script, you can run it manually as a root user to test it:

$ chmod +x renew_certificate.sh
$ ./renew_certificate.sh

Note that the certbot command will try to validate your website's URL by attempting to reach a temporary file that it will create on http://example.com/.well-known/acme-challenge/, so make sure that this location is accessible and serving the static files.

For more details about the Nginx Unit, check my previous blog post.

The cron job

If everything works as expected, you can add it to the root user's cron jobs to be executed weekly.

Export the current root cron jobs to a crontab.txt:

$ crontab -l > crontab.txt

Then edit it and add the weekly script to update the SSL certificate:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
SHELL=/bin/bash
MAILTO=""
@weekly /var/webapps/pybazaar/unit-config/renew_certificate.sh

Then run the following as the root user to apply it:

$ crontab crontab.txt

The good thing about not editing the cron job with crontab -e is that you can choose the editor and even put the crontab.txt under Git version control.

Happy web development with WSGI or ASGI!

Cover picture by Gotta Be Worth It

How To Convert AWS Route53 to Cloudflare Let’s Encrypt DNS challenge with acme.sh

I already wrote about setting up wildcard Let’s Encrypt SSL/TLS with AWS Route53 DNS for Nginx or Apache. One of my clients decided to use Cloudflare CDN and DNS at some point. They changed their DNS to Cloudflare. Naturally, their wildcard certificate failed because it was using Route53 DNS authentication to issue the certificate. Let us see how to convert existing or expired TLS/SSL certification renewal from AWS Route53 to Cloudflare.

Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit

The post How To Convert AWS Route53 to Cloudflare Let’s Encrypt DNS challenge with acme.sh appeared first on nixCraft.

Route 53 Let’s Encrypt wildcard certificate with acme.sh

How do I get a wildcard TLS/SSL certificate from Let’s Encrypt using acme.sh and AWS Route53? How can I set up wildcard Let’s Encrypt SSL with AWS Route53 for Nginx or Apache?

The post Route 53 Let’s Encrypt wildcard certificate with acme.sh appeared first on nixCraft.

How to issue Let’s Encrypt wildcard certificate with acme.sh and Cloudflare DNS

I read your Let's Encrypt TLS/SSL certificate acme.sh tutorial. But, I need to set up and use Cloudflare DNS with acme.sh. How do I secure my Nginx web server with Let's Encrypt TLS/SSL certificate issue with Cloudflare DNS?

The post How to issue Let’s Encrypt wildcard certificate with acme.sh and Cloudflare DNS appeared first on nixCraft.

How to secure Nginx with Let’s Encrypt on OpenSUSE 15.1/15.2

Let's Encrypt is a free, automated, and open certificate authority for your website, email server, database server and more. This page shows how to use Let's Encrypt to install certificate for Nginx web server get SSL labs A+ score on an OpenSUSE Linux version 15.1 or 15.2

The post How to secure Nginx with Let’s Encrypt on OpenSUSE 15.1/15.2 appeared first on nixCraft.

How To Secure Apache with mod_md Let’s Encrypt on Ubuntu 20.04 LTS

How do I secure Apache with mod_md Let's Encrypt on Ubuntu 20.04 and obtain a free TLS/SSL certificate? How do I secure Apache 2 with Let's Encrypt on Ubuntu 20.04 LTS server?

The post How To Secure Apache with mod_md Let’s Encrypt on Ubuntu 20.04 LTS appeared first on nixCraft.

How to forcefully renew Let’s Encrypt certificate

How do I forcefully renew the Letsencrypt certificate on an Ubuntu, Debian, CentOS, RHEL, Fedora, or FreeBSD Unix systems?

The post How to forcefully renew Let’s Encrypt certificate appeared first on nixCraft.

Apache with Let’s Encrypt Certificates on CentOS 8

I read that Let's Encrypt is a free, automated, and open certificate for web server and other usages. How do I secure Apache with Let's Encrypt Certificates on CentOS 8?

The post Apache with Let’s Encrypt Certificates on CentOS 8 appeared first on nixCraft.

How to secure Apache with Let’s Encrypt Certificates on RHEL 8

I read that Let's Encrypt is a free, automated, and open certificate for web server and other usages. How do I secure Apache with Let's Encrypt Certificates on RHEL 8?

The post How to secure Apache with Let’s Encrypt Certificates on RHEL 8 appeared first on nixCraft.