Short-lived certificates: a nuisance or an automation opportunity? - kowalski7ccShort-lived certificates: a nuisance or an automation opportunity?<br>Published on 2026-05-31

All posts

(Sticker by Puzzoz)

The advent of the World Wide Web, based on the HTTP (HyperText Transfer Protocol) protocol, introduced an incredible ability to connect information, but it did so by leaving a fundamental vulnerability: the lack of intrinsic security.

The traffic exchanged between a user and a server traveled in plaintext, a flaw that opened the door to a multitude of attacks. Malicious actors, using relatively simple tools, could intercept and read the entire conversation. Some will shudder recalling tools like Firesheep, which exploited this insecurity to make side-jacking trivial. This allowed the theft of active sessions from PCs connected to the same Wi-Fi network, granting access to social profiles or services as if the attacker were the legitimate user.

But the risks went far beyond simple interception: the lack of identity verification allowed attackers to impersonate a legitimate server (man-in-the-middle attacks) with the goal of stealing sensitive credentials, distributing malware, or committing fraud.

Faced with such a scenario, the need to protect communications and guarantee the authenticity of the parties involved strongly emerged. It was essential to ensure that the website the user was interacting with was actually the declared one and that the communication was incomprehensible to prying eyes. The solution to this dual problem was the evolution of HTTP into the HTTPS (HTTP Secure) protocol, achieved through the adoption and extension of the X.509 digital certificate system. These certificates, issued by trusted third-party organizations called Certification Authorities (CAs), play a crucial role.

Digital certificates fulfill two central and complementary functions for the security of web communications. The first function consists of enabling communication encryption, typically through protocols like SSL/TLS, which is an essential step to ensure the confidentiality and integrity of the data exchanged between parties.

In parallel, certificates are fundamental for validation and the fight against impersonation. This occurs because the issuance of a certificate by a Certification Authority (CA) is subject to the verification of domain ownership by the applicant. This mechanism ensures that the user's browser, by trusting the CA, obtains the necessary proof to validate that the server it is interacting with is actually who it claims to be, thereby preventing fraud attempts or man-in-the-middle attacks.

The introduction of this mechanism marked a turning point for web security.

However, the mass adoption of HTTPS was not immediate. For years, many websites(particularly personal blogs, small artisan sites, or less "critical" portals) continued to operate on insecure HTTP.

The reasons were often economic and logistical: certificates, although not prohibitively expensive (around ten euros a year or slightly more), still represented a fixed expense that was not always perceived as indispensable. Consequently, unprotected connections were frequently used, or, in an attempt to save money, self-signed certificates were employed. The latter, while guaranteeing encryption, were not issued by a recognized CA. As a result, browsers considered them untrusted, forcing users to manually confirm a security exception. This created a sub-optimal user experience and, above all, sent an ambiguous signal regarding security.

In the realm of home banking and e-commerce, however, maximum reliability is required. For a period of time, Extended Validation (EV) certificates were used in an attempt to further improve the certainty of being connected to the right site. This type of certificate could only be obtained through the verification of company documentation and involved a high cost, limiting its use to entities with specific needs. In return, users with this certificate saw the company name on a green background in the browser bar alongside the URL. We say "saw" in the past tense because this option was removed. It proved largely ineffective in protecting users, as certification authorities often failed to conduct truly in-depth checks.

The epochal turning point in the landscape of web security and certificate management arrived in 2016 with the public launch of Let's Encrypt .

This initiative, promoted by prominent organizations such as the Electronic Frontier Foundation (EFF), the Mozilla Foundation, and Cisco Systems, introduced a revolutionary concept: a fully automated certification authority (CA) that offers free X.509 certificates.

The impact of Let's Encrypt was immediately perceived as extremely positive, particularly by system engineers and server administrators.

Let's Encrypt my beloved! (Sticker by Puzzoz)

The keystone was the introduction of tools like certbot, a software client that automates the entire...