A short-lived certificate is not a classic 90-day certificate renewed aggressively. It is a distinct certificate profile requested through ACME, with a validity period designed around frequent automated replacement.
ACME profiles select certificate behavior
An ACME directory can advertise named profiles. A compatible client selects one when creating an order. Let's Encrypt currently advertises classic, tlsserver, and shortlived; the exact directory response is the authority, because profiles can evolve.
The profile is part of the order request. Merely scheduling a classic certificate more often does not convert it into a short-lived certificate.
Roughly 160 hours changes the failure budget
Let's Encrypt describes short-lived certificates as valid for about 160 hours, or a little under seven days. An operator therefore needs repeated successful issuance and deployment well before expiration. A job that quietly fails for several days can become an outage.
Renew according to the certificate authority's coordination signals and client behavior. Rotation frequency should leave enough time for retries without producing unnecessary orders.
Operational readiness matters more than the command
- Run unattended issuance and deployment on a durable schedule.
- Monitor the certificate actually served, not only the files written by the ACME client.
- Validate hostname coverage, key correspondence, chain, and remaining validity before activation.
- Keep credentials narrowly scoped and test recovery without depending on shell history.
- Alert with enough time for several retries and human intervention.
- Preserve an independently deployable last-known-good certificate until the replacement is verified.
ARI and rate limits still shape good automation
ACME Renewal Information lets a certificate authority suggest an appropriate renewal window. Compliant clients can coordinate replacements and, under Let's Encrypt policy, qualifying ARI renewals can be exempt from normal rate limits. That is not permission to request unlimited duplicate certificates. Operators should understand the current Let's Encrypt rate-limit documentation and verify the behavior of their exact client version.
For classic certificates, forcing the same identifier set every day can exceed the duplicate-certificate limit. For short-lived certificates, use a client and automation path that explicitly support the profile rather than simulating it through premature classic issuance.
AcmeMux does not support the profile yet
The AcmeMux MVP supports a reviewed subset of lego configuration. It currently classifies lego's certificate profile field as unsupported and blocks managed operations when that field is present. The live acmemux.com certificate therefore uses the classic profile.
This is a deliberate, visible limitation, not an invitation to edit around the control plane. Vote for short-lived profile support or fund the accepted roadmap work. Until then, the live dogfood status reports the real classic certificate and its estimated next evaluation.