Let’s Encrypt to Reduce Certificate Validity from 90 Days to 45 Days
Source Reddit InfoSec News
Description
Let’s Encrypt, a widely used certificate authority, plans to reduce the validity period of its SSL/TLS certificates from 90 days to 45 days. This change aims to improve security by limiting the window of exposure if a certificate is compromised. While this is not a vulnerability or exploit, it impacts certificate management processes and automation for organizations relying on Let’s Encrypt certificates. European organizations using Let’s Encrypt will need to adjust their renewal workflows to accommodate the shorter validity period. Failure to do so could lead to service disruptions due to expired certificates. The change does not introduce new attack vectors but increases operational demands on IT teams. Countries with high adoption of Let’s Encrypt certificates and strong digital infrastructure are more likely to be affected. This update underscores the importance of robust automation and monitoring in certificate lifecycle management. Overall, this is a security policy change rather than a direct threat or vulnerability.