Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This doesn't really work without the certificate expiration date also being 24-48h in the future, though.

I think they reissue the same 1y+ validity cert...



Some allow manually specifying the expiration times.


Entrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day.

I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: