pdl

@Ooops I do not understand what you mean with "they are failing to advertise this". Letsencrypt has announced in in their blog:
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs
https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued
The profiles are documented:
https://letsencrypt.org/docs/profiles/
It is your deciscion what profile to use. If you use the shortlived profile and your key is compromised, you benefit from the short lifetime. This benefit you have regardless of the availability of the 90 day certs.

@Ooops @stratself Certbot renews a certificate when the remaining lifetime is lower than 30 %. If you change the profile from tlsserver (90 days) to shortlived (6 days), you do not need to adjust the renewal interval manually, because it is relative to the cert livetime.
I think it is not Letsencrypt's part to document how to use the different profiles with certbot. It should be explained in the documentation of the ACME client (certbot and others).

@A_norny_mousse @state_electrician Three certs are free. If you need more (or wildcard certs) you have to pay.

@flandish If US authorities want to fake my server, they can use any CA, regardless which CA I originally used.
Of course, US authorities can force Letsencrypt to revoke my certificates and block any renewing. This is very unlikely to happen. If it happens, I have to change my CA. There would be a downtime for my private services, but there is no data corruption or data loss on my servers.

@flandish Which backdoor? When I request a CA for a certificate, I send the public key to the CA. The CA does a validation and signs the certificate.
The CA does not see any traffic from my server. A man-in-the-middle needs my private key, which is under my administration. If I loose my private key, it does not matter if the certificate is signed by a US based CA or an European CA.

@flandish @possiblylinux127 Letsencrypt just has the public keys, no private keys. If Letsencrypt gives my public keys to sam, it does not matter, because public keys are public. My private key is under my administration only.

@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server's IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.