Consider using the 'shortlived' certificate profile by default for Let's Encrypt

[mholt]

Issue Details

6-day certs (and IP certs) are now generally available with Let's Encrypt: https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

Short-lived certificates offer great benefits when automated, including no practical need for revocation even in the event of key compromise, as revocation would take almost as long to propagate across ecosystems as the key lifetime itself. Plus, the incentive for stealing a key is dramatically reduced when it can only be used for a very short period of time.

Also, quoting their blog post:

We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

Caddy defaulting to short-lived certs can help prove this methodology.

Additionally, with the sunsetting of OCSP stapling, which Caddy implemented very effectively and by default, short-lived certs can effectively replace the benefits granted by the now-discontinued OCSP stapling, which caused Caddy to get a new cert immediately upon key compromise. If short-lived certs are the default, again, there is no practical need for revocation and replacing the cert frequently is an effective substitute.

Assistance Disclosure

AI not used

If AI was used, describe the extent to which it was used.

No response

[raylu]

is there a way to do this myself right now? I see some issue comments with

tls {
  issuer acme {
    dir https://acme-staging-v02.api.letsencrypt.org/directory
    profile shortlived
  }
}

but I don't see that documented in https://caddyserver.com/docs/caddyfile/directives/tls#issuers

[chenxiaolong]

I think that works fine to configure it per site. It can also be done globally with:

{
    cert_issuer acme {
        dir https://acme-v02.api.letsencrypt.org/directory
        email user@domain
        profile shortlived
    }
}