361
Let's Encrypt Announces New-Certificate-Every-6-Days Offering
(letsencrypt.org)
This is a most excellent place for technology news and articles.
When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn't the biggest issue with server certificates.
Yes X.509 is broken. If you're a developer and not pinning certs, you're doing it wrong.
Yeah, now imagine pinning certs that change weekly.
My first thought is that old school secure software (like claws-mail) treats a cert change as a minor security incident, asking you to confirm every time. Completely different school of thought.
You can pin to your own CA. Then it doesn't matter if you want to update your certs frequently.
Right