Patrick O'Callaghan wrote: > On Tue, 2025-05-27 at 19:59 +0930, Tim via users wrote: >>> If you have it all fully automated, it shouldn't hurt to use >>> the shorter lifetime, but for the purposes being discussed >>> here, it _seems_ like a moot point. >> >> I'm not sure I believe in their automation ideas, at all (having read >> further into their website). >> >> If someone managed to hack into my (externally hosted) website and take >> it over, it'd continue updating the certificate under their control. >> But if I had to be the one updating the certificate, it wouldn't get >> automatically updated in my absence. If you didn't notice the system was compromised in order to stop the automatic renewal, why would you notice it when you manually renewed the certificate though? The problems are a bit orthogonal. I don't take it as a given than doing it manually means you're any more (or less) likely to notice a system compromise. > I'd say that if someone penetrates your website, you have worse > problems than certificate renewal. Indeed. If a server admin doesn't notice (or worse, ignores) a system compromise, with or without automation, they're a danger (or at least a nuisance) to the rest of the network. That is still a real problem, but it can't be solved by certificate automation. Many other issues can be though, so in general, the plans to lower cert lifetime is a good one, I think. It is worth noting that the very short time Barry mentioned the other day (47 days) is not coming into effect for another 4 years. It will get shorter in a couple of increments on the way to that value and in the process, (most) folks will adapt to using automated renewal tools. For the moment, if anyone wants to pay a few bucks and get a cert which is value for 398 days, that's easy to do. Depending on how much time you want to invest in learning and implementing one of the various methods of automation, the cost of buying a cert versus getting one for "free" might skew well in favor of the former. -- Todd
Attachment:
signature.asc
Description: PGP signature
-- _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
