r/PKI

Let's Encrypt moving to 64-day validity in early 2027.

https://letsencrypt.org/2026/10/07/64-day-certs

I think this will be a good thing. They already offer, like many CAs, short-lived certs as an option. Moving everyone that doesn't do this down to 64 days should help to find all the little bugs that have been long-standing based on the assumption that everything is 90-day. Would be great if they supported notAfter in the order object, I think.

Auth reuse going down is another good thing - it'd be nice to get to a verify-every-certificate state.

What do people think?

u/isnotnick — 6 days ago

▲ 3 r/PKI

Probed 31 financial-sector sites for hybrid PQ key exchange: 23 negotiate X25519MLKEM768, 8 don't (2 of those only speak TLS 1.2)

I ran openssl s_client against 32 bank, insurer and payment hostnames on 7-9 Oct. 31 answered: 23 got X25519MLKEM768, 8 fell back to plain X25519, 2 of those never got past TLS 1.2. One bare domain refused, its www host answered.

Convenience sample, one vantage point, key exchange only. For a PCI DSS 12.3.3 crypto inventory: do you record what the public edge negotiates, or only what the origin supports?

reddit.com

u/PrestigiousOnion1087 — 6 days ago