Let's Encrypt: 64-Day Certificate Lifetimes Coming Feb 2027

The safest certificates are the ones that have expired before they were generated. Zombie Cat Quantum Security Corporation FTW!

/s

You could also go straight for DANE and get rid of CAs entirely.

Because while the Internet and subsequently the WWW was conceived as a medium where all peers were treated equally and no centralized gatekeepers were required, this policy was widely viewed to be a Bad Idea in retrospect, treated as a bug, and fixed accordingly.

Because the people on the CA/B Forum is doing security theater and doesn't have a practical view of security risks. But the tech companies that employ them view them as authorities and won't fire them for promoting dumb ideas.

The CA/B is the embodiment of the phrase "if all you have is a hammer, everything looks like a nail".

To act as a forcing function to automate certificate issuance and rotation.

In aggregate this is a very good thing

Because large organisations have demonstrated over time that they are fundamentally incapable of managing their certs effectively.

They usually grow enormous bureaucratic theatre around long-lived cert renewal, leaving them unable to do rapid rotation when it is required. And rather than getting their shit together, they prefer suing their CA to avoid revocation.

Given that those organisations 1) are crucial for day-to-day life (like banks, or the government), and 2) would have a giant blast radius when their certs are compromised, and 3) won't voluntarily change, the only remaining option to keep the ecosystem healthy is to force them by making complex rotation processes extremely painful and cumbersome to keep.

Hence: automated renewal, and boil the frog by slowly lowering the validity period.