Let's Encrypt: 6-Day and IP Certificates Coming in 2025

Let’s Encrypt has announced two significant feature updates: six-day validity certificate options and IP address certificate support, both set to roll out throughout 2025. These initiatives aim to enhance Web PKI security and provide SSL/TLS certificate support for more use cases.

Six-Day Certificates: Enhanced Security

The newly introduced six-day validity certificates (or “short-lived certificates”) will be offered alongside the existing 90-day certificates. This shorter validity period brings several advantages:

• Reduced Security Risks: When certificate private keys are compromised, the shorter validity period significantly reduces the potential window of exposure
• Less Reliance on Revocation: The natural expiration of short-lived certificates reduces the need for certificate revocation mechanisms
• Automation Promotion: Short-lived certificates effectively require users to implement automated certificate renewal, aligning with Let’s Encrypt’s long-advocated best practices

IP Address Certificate Support: Expanding Use Cases

In addition to short-lived certificates, Let’s Encrypt will support including IP addresses as Subject Alternative Names in six-day certificates. This feature will:

• Enable secure TLS connections directly through IP addresses
• Provide trusted certificates without requiring domain names
• Support validation through http-01 and tls-alpn-01 challenge types

Release Timeline

Let’s Encrypt plans to roll out these new features according to the following schedule:

• February 2025: First internal test certificates
• April 2025: Short-lived certificates available to early adopters
• End of 2025: Full availability of short-lived certificates and IP address support

How to Use the New Features

To utilize these new features, users will need to:

1. Ensure their ACME client supports certificate profile configurations
2. Select the short-lived certificate profile (specific name to be announced)
3. For IP address certificates, the system will automatically select the short-lived certificate profile

Preparation Recommendations

If you plan to use short-lived certificates, it’s recommended to prepare by:

• Ensuring your ACME client can reliably auto-renew certificates
• Testing and refining your certificate automation processes
• Following Let’s Encrypt’s announcements for further technical details

This update marks another significant step in Let’s Encrypt’s mission to advance web security, offering more flexible certificate options and shorter validity periods to enhance the overall security of the Web PKI.

Original Article