January 16, 2026
Short certs, long comment wars
6-Day and IP Address Certificates Are Generally Available
Let’s Encrypt’s 6‑day “quick locks” and IP sign‑ins land — fans cheer while tools scramble
TLDR: Let’s Encrypt launched 6‑day and IP address certificates to tighten security by refreshing fast. Commenters love the idea but gripe that tools like Certbot lag, trade Lego tips, and debate whether this finally makes dev setups simpler or forces everyone into full automation ASAP.
Let’s Encrypt just dropped two spicy updates: ultra‑short 6‑day certificates and the ability to secure connections to a raw IP address (think “calling a house by its number, not its name”). The security crowd is hyped: shorter lifetimes mean stolen keys go stale fast, shrinking the panic window from months to days. They’re also teasing a future shift from 90‑day to 45‑day defaults. Translation: refresh often, sleep better.
But the comments? Pure popcorn. Tool drama exploded when users noticed popular helper app Certbot doesn’t handle IP certificates yet. One commenter flagged an open PR and sighed “not today.” Another shared a workaround with Lego (a different tool), admitting it took a bit of command‑line spelunking. The vibe is automation or bust—if your renewals aren’t fully hands‑free, six‑day certs will test your nerves.
Meanwhile, devs dreamed up hot use cases: ephemeral services that spin up for an hour, chat over encrypted lines, then vanish, no domain names required. Others asked, “Can this kill my self‑signed localhost setup?” Cue jokes like “six‑day detox for certs,” “cron leg day,” and the eternal “When does Caddy support this?” It’s a perfect storm of security glow‑up meets tooling chaos, with the crowd split between cheering the future and begging their apps to catch up.
Key Points
- •Short-lived certificates from Let’s Encrypt are generally available with a 160-hour validity.
- •Short-lived certificates are opt-in and obtained by selecting the ‘shortlived’ profile in an ACME client.
- •They aim to improve security by reducing reliance on unreliable certificate revocation mechanisms.
- •Let’s Encrypt plans to reduce default certificate lifetimes from 90 days to 45 days over the next few years.
- •IP address certificates for TLS (supporting IPv4 and IPv6) are generally available and must be short-lived.