6 Day Certs Are Here: Why SSL Certificate Lengths are Getting Shorter

For years, SSL/TLS certificates were treated like digital passports - issued once and forgotten for a year or two. But things are changing. Fast. If you've been paying attention to the web's infrastructure lately, you might’ve noticed an accelerating trend: SSL certificate lifetimes are shrinking. If you're a dinosaur like me and have been working on the web since the 90s, you may recall certificates that were 3 years in length. Then it became 2 years and 1 year.

Recently, 90 days became the new normal. Now, Let’s Encrypt is offering 6 day certificates. You read that right: The SSL cert will expire less than ONE WEEK after it is issued. So what’s going on here? Why are cert lifetimes getting so short? Is this a good thing? And how should you adapt?

The Case for Shorter Certificates: 6 Day Certs

The shift toward shorter lifespans is a deliberate move to improve security, reliability, and resilience across the internet. Here’s why:

Certificate authorities (CAs), especially Let's Encrypt, play a crucial role in managing short-lived certificates and are pushing the upcoming Automatic Renewal Information (ARI) standard. As ARI gains traction and moves toward formalization, it is anticipated that more CAs will adopt this protocol, improving security in certificate management. Below I'll break down all the reasons why 6 day certs will benefit the security of the web:

Benefits of Short-Lived Certificates

Short-lived certificates offer several compelling benefits that enhance the security and efficiency of your digital infrastructure:

1. Improved Security: By minimizing the exposure time during a key compromise event, short-lived certificates significantly reduce the risk of unauthorized access. If a private key is compromised, the certificate’s short lifespan limits the window of opportunity for malicious use.

2. Reduced Risk of Certificate Revocation: With shorter certificate lifetimes, the urgency and frequency of certificate revocation diminish. Since certificates expire quickly, the potential for a problematic certificate to cause harm is minimized.

3. Encouraging Automation: Short-lived certificates practically mandate the use of automation. This shift is crucial for security, as automated processes reduce human errors and close potential vulnerabilities.

4. Increased Flexibility: Managing certificates with shorter lifetimes allows for more frequent rotations, reducing downtime and making the system more adaptable to changes and updates.

Understanding SSL Cert Lifetimes

A certificate "lifespan" refers to the duration for which an SSL remains valid. Traditionally, certs have lifetimes spanning several months to years. However, short-lived SSL certs, such as 6-day certificates, represent a significant shift towards enhancing security and efficiency. Understanding these lifetimes is essential for effective certificate management and maintaining the integrity of the TLS ecosystem. Short-lived certificates ensure that any potential vulnerabilities are short-lived, thereby bolstering overall security.

Minimizing the Blast Radius of Compromised Keys

If a private key is stolen or a certificate is issued in error, a shorter validity window limits how long that certificate can be used maliciously. The challenges associated with revoking compromised certificates, such as ensuring that a certificate revoked is no longer trusted, are mitigated by adopting shorter lifetimes. Instead of a multi-year vulnerability, you’re looking at a risk window measured in days.

The Revocation Situation

The idea behind certificate revocation is simple: Maintain a central list of certs that should no longer be honored and check it before showing a website. But revocation has historically been a weak spot in the SSL ecosystem. Many browsers don’t reliably check whether a certificate has been revoked or don’t do so often enough. With short-lived certs, revocation becomes less critical - the cert will expire quickly on its own.

Certificate transparency is crucial in this context. Monitoring short-lived certificates within Certificate Transparency logs ensures the entire lifecycle of these certificates is tracked, showcasing a commitment to transparency and innovation in certificate management.

Forcing Automation

Short-lived certificates encourage operators to embrace automation. Well, let’s be honest. At 6 days you are FORCED to automate the process. Automation reduces human error, ensures timely renewals, and makes the whole ecosystem more agile. Automating certificate issuance is crucial for improving security, particularly in the context of short-lived certificates. The rise of tools like ACME has made automated certificate management accessible even to smaller teams.

The Role of Automation in Six-Day Certificates

Automation is the backbone of managing six-day certificates. Given the shorter certificate times, automation ensures that certificates are renewed and updated seamlessly. Tools like ACME clients are designed to handle these renewals, preventing certificates from expiring unexpectedly. By automating the certificate issuance and renewal process, you minimize human errors and vulnerabilities, making your certificate management more robust and reliable. Automation is not just a convenience; it’s a necessity for maintaining security in a landscape where certificate lengths are continually shrinking.

Improving Major Incident Response

Does anyone remember Heartbleed? It was a huge vulnerability and we all had to rotate keys after it was discovered. A shorter average certificate lifetime means a faster refresh cycle across the web and limits the need to rotate keys (they'll expire in a few days anyway!). Shorter certificate lifespan makes the entire system easier to update and recover.

Why Six Day Certificates?

Let’s Encrypt’s new 6-day certificate option is an aggressive step toward a future where certificates are transient or even ephemeral. If 90 days was a push toward automation, six days is a SPRINT towards automation. These ultra-short certs are opt-in (for now) and only practical for those already comfortable with automated issuance and renewals.

But the security payoff is real: a six-day certificate is gone before a revocation notice would have had time to propagate in most cases. That’s a HUGE improvement in real-world protection.

Implementing Six-Day Certificates

Implementing six-day certificates requires a strategic approach to ensure smooth operation and security. Here are the steps to consider:

1. Choose an ACME Client: Select an ACME client that supports the necessary certificate profiles and can manage renewals and updates efficiently.

2. Configure Automation: Set up automation tools to handle the renewal and update processes. This ensures that your certificates are consistently renewed without manual intervention.

3. Test and Validate: Conduct thorough testing to validate that certificates are being issued and renewed correctly. This step is crucial to catch any potential issues before they affect your live environment.

4. Monitor and Maintain: Continuously monitor the implementation to ensure that certificates remain up-to-date and secure. Regular maintenance and monitoring help in promptly addressing any issues that may arise.

By following these steps, you can effectively implement six-day certificates, leveraging automation to maintain a secure and resilient digital infrastructure.

When Are 6-Day Certificates Renewed?

How often will you need to renew a six-day cert? Good question. Either way, you won’t be doing it manually. Most ACME clients renew certificates when about two days remain, typically around day 4 of the certificate’s life. This buffer gives time to retry in case of transient errors and prevents last-minute scrambles.

Certificate renewal is crucial for maintaining website security, and the ACME protocol streamlines this process by automating the obtaining and renewing of SSL/TLS certificates. This automation prevents unexpected certificate expirations and ensures seamless renewals.

Let’s Encrypt also supports an extension called ARI (Automatic Renewal Information), which lets your client know the ideal renewal time. This helps distribute renewal traffic more evenly and ensures smooth operation at scale.

What This Means for You

The industry is clearly moving toward shorter-lived, automatically-renewed certificates. Whether you're running a single website or managing infrastructure at scale, this change signals a shift in best practices:

• Manual renewals are dead. Embrace automation.

• Certificate monitoring is essential. Shorter lifetimes mean smaller windows to catch failures before they cause outages.

• Stay informed. The pace of change in the TLS ecosystem is accelerating - be ready to adapt.

Certificate Monitoring is a Must

If you’re adopting short-lived certificates, you’ll need a way to monitor them - whether that’s a cron script, a dashboard, or a third-party tool like TrackSSL. Monitoring ensures you’re alerted to renewal failures before they lead to downtime. It’s a lightweight and effective safety net in a fast-moving landscape.

Additionally, ensuring that the ACME client is reliably renewing certificates in an automated manner is crucial for effectively transitioning to short-lived certificates. This consistent and dependable renewal process can eliminate potential costs associated with the switch.

The Bottom Line on 6 Day SSL Certs

Six-day certs might sound extreme today - but so did 90-day certs just a few years ago. As the web continues to evolve, expect to see even shorter certificate lifetimes and more aggressive automation. Shorter-lived certificates, such as those with a lifetime of six days, enhance security by reducing exposure during potential key compromise events. However, they also require operational changes to accommodate the anticipated increase in certificate issuance. Shorter than 6 days? Well, let’s wait and see. But the good news is that with the right tools, automation, and some best practices, it doesn’t have to be harder - just smarter.