6-day and IP Address Certificates are Generally Available
Update: March 11, 2026
If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates.
Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscribers simply need to select the ‘shortlived’ certificate profile in their ACME client.
Short-lived certificates improve security by requiring more frequent validation and reducing reliance on unreliable revocation mechanisms. If a certificate’s private key is exposed or compromised, revocation has historically been the way to mitigate damage prior to the certificate’s expiration. Unfortunately, revocation is an unreliable system so many relying parties continue to be vulnerable until the certificate expires, a period as long as 90 days. With short-lived certificates that vulnerability window is greatly reduced.
🚨Breaking news! Let's Encrypt is *almost* ready to issue IP address certificates—just not to you. 😂 Expect 6-day certificates under an exclusive 'allowlist' that you can't access yet. But don't worry, they'll keep doing "more work" with the urgency of a sloth in a hammock. 🙄💤
https://community.letsencrypt.org/t/getting-ready-to-issue-ip-address-certificates/238777 #LetsEncrypt #IPAddressCertificates #Allowlist #SlothInAHammock #BreakingNews #HackerNews #ngated
Getting ready to issue IP address certificates
Is there anything public available on which IPs will be able to get certs? I mean, obviously private/reserved ranges won't be available, but how about all those "cloud" services that rent IPs by the hour (or second)? Is it expected to be "normal" that someone could release an IP back into a pool and yet still have a valid certificate for almost-a-week, or will Let's Encrypt certificates only be available for IPs that are slightly less ephemeral?
Getting ready to issue IP address certificates
Is there anything public available on which IPs will be able to get certs? I mean, obviously private/reserved ranges won't be available, but how about all those "cloud" services that rent IPs by the hour (or second)? Is it expected to be "normal" that someone could release an IP back into a pool and yet still have a valid certificate for almost-a-week, or will Let's Encrypt certificates only be available for IPs that are slightly less ephemeral?
Hacker News
N-gated Hacker News