acme

Let's Encrypt将于2027年2月10日起把免费SSL/TLS证书有效期从90天缩短至64天，并计划在2028年进一步缩短至45天，以推动ACME自动化续期的普及。

Let's Encrypt announced that starting February 10, 2027, all issued certificates will default to a 64-day lifetime, down from 90 days, as part of a phased plan toward 45-day lifetimes in 2028. The change also reduces authorization reuse periods and encourages users to automate renewal via ARI.

All Systems Go 2026 talk by Morten Linderud introducing attezt, a Linux tool suite implementing the IETF's new device-attest-01 ACME challenge for provisioning device-bound certificates, including an ACME client, attestation server, and PKCS11 agent.

Explains how to set up TLS certificates for internal services using split-horizon DNS, a VPN with DNS resolver, and ACME clients like acme.sh with Let's Encrypt, providing a practical alternative to self-signed certificates.

An analysis and reproduction of lawful TLS wiretapping using ACME automation, based on a real incident involving Russian XMPP service Jabber.ru, demonstrating how certificate-based intercepts can be implemented and detected.

The CA/Browser Forum has voted to make ACME CAA extensions mandatory by March 2027, a key step toward strong cryptographic domain validation using DNSSEC.