[mike_d]

I understand all of the benefits with regards to compromise and pushing automation, but I really hope they don't push the maximum lower.

It is already getting dangerously close to the duration of holiday freeze windows, compliance/audit enforced windows, etc.

Not to mention the undue bloat of CT logs.

[ndsipa_pomu]

> It is already getting dangerously close to the duration of holiday freeze windows, compliance/audit enforced windows, etc.

How do those affect automated processes though? If the automation were to fail somehow during a freeze window, then surely that would be a case of fixing a system and thus not covered by the freeze window.

> Not to mention the undue bloat of CT logs.

I'm not sure what you mean by "CT logs", but I assume it's something to do with the certificate renewal automation. I can't see that you'd be creating GBs of logs that would be difficult to handle. Even a home-based selfhosted system would easily cope with certificate logs from running it hourly.

[phasmantistes]

"CT Logs" are Certificate Transparency Logs, which are cryptographically provable append-only data structures hosted by trusted operators. Every certificate issued is publicly logged in two or more CT Logs, so that browsers can ensure that CAs aren't lying about what certs they have or have not issued.

Reducing the lifetime of certificates increases the number of certificates that have to be issued, and therefore the number of certs that are logged to CT. This increases the cost to CT operators, which is unfortunate since the set of operators is currently very small.

However, a number of recent improvements (like static-ct-api and the upcoming Merkle Tree Certs) are making great strides in reducing the cost of operating a CT log, so we think that the ecosystem will be able to keep up with reductions in cert lifetime.