中文

Glossary

Short-Lived Certificate

Last verified

Definition

Short-lived certificates are TLS certificates valid for only a few days, so expiry rather than revocation limits how long a compromised one can be misused.

A short-lived certificate has a validity period measured in days rather than months. The CA/Browser Forum Baseline Requirements give the term a specific meaning: under Ballot SC-063, subscriber certificates valid for 7 days or less (for certificates issued from 2026-03-15) count as short-lived and need not include OCSP or CRL pointers. Let's Encrypt made six-day (160-hour) certificates generally available on 2026-01-15 through its shortlived ACME profile, which is also the profile for its IP-address certificates.

Why it matters

Revocation has long been unreliable: clients often skip status checks or soft-fail when they cannot complete them, OCSP is now optional for CAs, and Let's Encrypt has shut its OCSP service down. A certificate that expires within days caps the damage of a stolen key without depending on any revocation check. The price is that renewal must be fully automated and robust; with a six-day lifetime, a failed renewal job becomes an outage within days. ACME Renewal Information (ARI, RFC 9773) lets the CA tell clients when to renew.

Example

openssl x509 -in cert.pem -noout -startdate -enddate
# notBefore=Nov 10 00:00:00 2026 GMT
# notAfter=Nov 16 16:00:00 2026 GMT    (160 hours after notBefore)

Common misconceptions

  • Short-lived means weaker. The cryptography is identical; only the validity window is shorter.
  • The coming 47-day limit makes every certificate "short-lived". In Baseline Requirements terms, short-lived means 7 days or less; 47 days is the general maximum from 2029-03-15.
  • You can manage them by hand. Renewal every few days is only practical with ACME automation and monitoring.

See also