6天和IP地址证书现已普遍可用。

6天和IP地址证书现已普遍可用。
6-Day and IP Address Certificates Are Generally Available

原始链接: https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

Let’s Encrypt 现在提供有效期仅为六天多一点（160小时）的短寿命 TLS 证书，可通过 ACME 客户端中的“shortlived”配置激活。这些证书通过最大限度地减少受损私钥的影响来增强安全性，因为与传统的 90 天证书有效期和不可靠的撤销系统相比，漏洞窗口大大缩短。与此同时，Let’s Encrypt 现在支持 IPv4 和 IPv6 的 IP 地址证书，*要求*使用短寿命时长，因为 IP 地址的性质是瞬变的。虽然尚未成为默认设置，但 Let’s Encrypt 计划在未来几年将标准证书的有效期缩短至 45 天。这些功能的引入旨在加强整体 TLS 安全性，并依赖于自动续订流程以实现无缝采用。这项工作得到了开放技术基金和主权技术机构的支持。

Let's Encrypt 现在通常支持直接为IP地址颁发证书，此功能之前无法通过其常用工具Certbot使用。虽然存在Certbot的IP地址支持拉取请求，但尚未实现。目前想要IP证书的用户需要使用替代ACME客户端，如`lego`或`acme.sh`。一位用户分享了一个可用的`lego`命令来获取短期证书。 IP地址证书的主要好处在于，能够为临时、快速部署的服务（例如仅持续数小时的服务）启用TLS通信，而无需配置DNS记录。这简化了设置，并为这些短期部署提供了一定程度的匿名性，因为不再依赖注册商，但需要注意的是，IP地址仍然由ARIN等注册商分配。这对于非面向人类的服务尤其有用。

原文

Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscribers simply need to select the ‘shortlived’ certificate profile in their ACME client.

Short-lived certificates improve security by requiring more frequent validation and reducing reliance on unreliable revocation mechanisms. If a certificate’s private key is exposed or compromised, revocation has historically been the way to mitigate damage prior to the certificate’s expiration. Unfortunately, revocation is an unreliable system so many relying parties continue to be vulnerable until the certificate expires, a period as long as 90 days. With short-lived certificates that vulnerability window is greatly reduced.

Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

Our default certificate lifetimes will be going from 90 days down to 45 days over the next few years, as previously announced.

IP address certificates allow server operators to authenticate TLS connections to IP addresses rather than domain names. Let’s Encrypt supports both IPv4 and IPv6. IP address certificates must be short-lived certificates, a decision we made because IP addresses are more transient than domain names, so validating more frequently is important. You can learn more about our IP address certificates and the use cases for them from our post announcing our first IP Certificate.

We’d like to thank the Open Technology Fund and Sovereign Tech Agency, along with our Sponsors and Donors, for supporting the development of this work.

6天和IP地址证书现已普遍可用。 6-Day and IP Address Certificates Are Generally Available

6天和IP地址证书现已普遍可用。
6-Day and IP Address Certificates Are Generally Available