Lets encrypt short lived certificates in traefik

Chat
1

Lets encrypt supports short lived certs, see 6-day and IP Address Certificates are Generally Available - Let's Encrypt
Thanks to @capote who informed me.

Just for fun I tried it with traefik and it worked.

Edit traefik.yaml:

runagent -m traefik1 nano traefik.yaml

Add profile: shortlived to use the shortlived profile:

...
certificatesResolvers:
  acmeServer:
    acme:
      profile: shortlived
      email: null
...

Restart traefik to apply config:

runagent -m traefik1 systemctl --user restart traefik

Now when requesting an LE cert, it is short lived and expires after 6 days so you’ll get a warning that the cert expires immediately :grinning_face_with_smiling_eyes:

1 Like
2

And what is the practical usage if I may ask?

1 Like
3

I was thinking “Oh, goody.” :rofl:

4

It doesn’t have to contain revocation information (like CRL info), so it can be smaller. You can also issue certs for IP addresses under this profile. If you don’t need a cert for an IP, there probably isn’t any real benefit.

I’d be more interested in a switch to the tlsserver profile, since I think that’s where they’re heading in any event–the CN field is gone, it uses the new roots, it doesn’t include the tlsclient EKU.

1 Like
5

Note that there seems to be a bug in Traefik that prevents profiles from being used on cert renewal–it looks like that’s fixed somewhere in the 3.6 series, but NS8 is currently using 3.5.1:

2 Likes
6

More information about the available certificate profiles:

2 Likes