6-Day and IP Address Certificates Are Generally Available (letsencrypt.org)

Article summary

Let's Encrypt has made 6-day and IP address certificates generally available, allowing for more frequent validation and reducing reliance on revocation mechanisms. These certificates are valid for 160 hours and can be obtained by selecting the 'shortlived' certificate profile in an ACME client. IP address certificates enable server operators to authenticate TLS connections to IP addresses rather than domain names. The introduction of these certificates aims to improve security and provide more flexibility for users.

Main themes

• Let's Encrypt updates
• Certificate security
• IP address certificates
• TLS authentication
• Certificate validation
• Revocation mechanisms

What commenters say

• The introduction of IP address certificates is useful for ephemeral services that require TLS communication without relying on DNS.
• Some commenters argue that IP address certificates can simplify the configuration of DNS over TLS and HTTPS.
• Others believe that the value of encrypted client hello (ECH) is minimal for self-hosted sites with few domains, as the IP address can be used to determine the domain names.
• There is disagreement over the usefulness of ECH for hiding server names, with some arguing it provides minimal privacy benefits for small sites.
• IP address certificates may not be suitable for use with ECH due to technical limitations and IETF draft restrictions.
• The use of IP address certificates can reduce the dependency on DNS and registrars, but may not eliminate the need for trusted authorities entirely.
• Some users see IP address certificates as a way to avoid the complexity of obtaining a domain name for temporary or development projects.
• The support for IP address certificates in popular tools like Certbot and Caddy is still evolving, with some users experiencing difficulties or limitations.