454
Decreasing Certificate Lifetimes to 45 Days
(letsencrypt.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 02 Dec 2025
454 points (100.0% liked)
Selfhosted
53454 readers
349 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Ours is automated, but we incur downtime on the renewal because our org forbids plain http so we have to do TLS-ALPN-01. It is a short downtime. I wish let's encrypt would just allow http challenges over https while skipping the cert validation. It's nuts that we have to meaningfully reply over 80...
Though I also think it's nuts that we aren't allowed to even send a redirect over 80...
Forgive my ignorance but why would that incur a downtime?
The only way I can think of for downtime to happen if you switched certs before the new one was signed (in which case ..don't) or am I missing something?
It also strikes me as weird that LE requires 80 but does allow insecure 443 after a redirect. Why not just do/allow insecure 443 in the first place?
the TLS-ALPN-01 challenge requires a https server that implements generating a self-signed certificate on demand in response to a specific request. So we have to shut down our usual traffic forwarder and let an ACME implementation control the port for a minute or so. It's not a long downtime, but irritatingly awkward to do and can disrupt some traffic on our site that has clients from every timezone so there's no universal '3 in the morning' time, and even then our service is used as part of other clients '3 in the morning' maintenance windows... Folks can generally take a blip in the provider but don't like that we generate a blip in those logs if they connect at just the wrong minute in a month...
As to why not support going straight to 443, don't know why not. I know they did TLS-ALPN-01 to keep it purely as TLS extensions to stay out of the URL space of services which had value to some that liked being able to fully handle it in TLS termination which frequently is nothing but a reverse proxy and so in principle has no business messing with payload like HTTP-01 requires. However for nginx at least this is awkward as nginx doesn't support it.
Thanks for the explanation!
Though it ought to be possible to only respond with the new self-signed cert when LE does the challenge and with the previous, properly signed cert otherwise.
I found https://codeberg.org/neilpang/acme.sh/wiki/TLS-ALPN-without-downtime which demonstrates one method to achieve that but I lack practical experience judge whether that's optimal.
is redirecting http to https also out of the question? because let's encrypt HTTP-01 accepts http -> https redirects:
They in fact refuse to even do a redirect... it's monumentally stupid and I've repeatedly complained, but 'security' team says port 80 doing anything but dropping the packet or connection refused is bad...
oh my god
Can't use DNS?
The same screwed up IT that doesn't let us do HTTP-01 challenges also doesn't let us do DNS except through some bs webform, and TXT records are not even vaguely in their world.
It sucks when you are stuck with a dumber broad IT organization...
Yikes. I feel for you man.
Wow...