Certificate Profile Selection (Let's Encrypt)
Let's Encrypt has introduced "profile selection" for certificate requests, allowing users to choose from profiles like "classic" and "tlsserver," with a "shortlived" profile coming soon for six-day certificates.
Read original article
Let's Encrypt has announced a new feature called "profile selection" as an extension to its implementation of the ACME protocol. This feature allows site operators and ACME clients to choose from different certificate profiles when requesting certificates. The staging environment now includes a new field in its directory resource that lists available profiles, including the "classic" profile, which maintains the traditional certificate attributes, and the "tlsserver" profile, designed specifically for TLS server usage with several modifications. Notably, the "tlsserver" profile omits the Common Name field and Subject Key Identifier, aligning with current Baseline Requirements. A forthcoming "shortlived" profile will also be introduced, offering certificates with a validity of only six days. ACME clients can specify their desired profile in new-order requests, and if not specified, the server will select one automatically. Site operators and ACME client users are encouraged to monitor their clients for updates regarding this feature and to test the new profiles in the staging environment. Further information will be provided as the implementation progresses towards production.
- Let's Encrypt introduces "profile selection" for certificate requests.
- New profiles include "classic" and "tlsserver," with specific attributes for each.
- A "shortlived" profile will be available soon, offering certificates valid for six days.
- ACME clients can specify profiles in new-order requests.
- Users are encouraged to test the new profiles and provide feedback.
Related
Letsencrypt Supports Wildcard Certificates
Let's Encrypt offers free SSL/TLS certificates for secure HTTPS connections, relying on donations. They issue Domain Validation and SAN certificates, recommend reporting malicious activities, and emphasize TLS/SSL security.
Let's Encrypt adds random JSON fields
Let's Encrypt is updating its ACME protocol by adding random keys to the /directory endpoint to enhance client compatibility, addressing issues with certificate renewal and API connectivity reported by users.
A Note from Our Executive Director
Let's Encrypt, serving over 500 million websites, plans to introduce six-day TLS certificates to enhance security. The organization emphasizes automation and relies on donations for ongoing projects as it celebrates its 10th anniversary.
Short-Lived Certificates Coming to Let's Encrypt
Let's Encrypt will introduce six-day short-lived certificates next year to enhance TLS security by reducing key compromise exposure. The transition is expected to be seamless for subscribers due to automation.
We have an unusual concern when we use Let's Encrypt
Chris Siebenmann raises concerns about Let's Encrypt's 6-day TLS certificates for large organizations like the University of Toronto, highlighting potential rate limit issues and risks of critical certificate expirations.
1 commentsRelated
Letsencrypt Supports Wildcard Certificates
Let's Encrypt offers free SSL/TLS certificates for secure HTTPS connections, relying on donations. They issue Domain Validation and SAN certificates, recommend reporting malicious activities, and emphasize TLS/SSL security.
Let's Encrypt adds random JSON fields
Let's Encrypt is updating its ACME protocol by adding random keys to the /directory endpoint to enhance client compatibility, addressing issues with certificate renewal and API connectivity reported by users.
A Note from Our Executive Director
Let's Encrypt, serving over 500 million websites, plans to introduce six-day TLS certificates to enhance security. The organization emphasizes automation and relies on donations for ongoing projects as it celebrates its 10th anniversary.
Short-Lived Certificates Coming to Let's Encrypt
Let's Encrypt will introduce six-day short-lived certificates next year to enhance TLS security by reducing key compromise exposure. The transition is expected to be seamless for subscribers due to automation.
We have an unusual concern when we use Let's Encrypt
Chris Siebenmann raises concerns about Let's Encrypt's 6-day TLS certificates for large organizations like the University of Toronto, highlighting potential rate limit issues and risks of critical certificate expirations.