Six day and IP address certificate options in 2025

I don't disagree with anything they say here:

https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/#short...

But... How often do these types of compromises happen? I can't say I've ever seen or heard of it happening.

Impossible to say, as most people probably don't even know that their private key is stolen. I've personally seen it only once on a real certificate revocation. Yet another reason to have shorter lifespan.

Often enough a protocol was made to deal with it. The compromises have mostly been kept quiet though or at least didn’t get much news traction.

It's a pretty narrow threat model for Alice to get her cert stolen by Bob, be completely unaware that this has happened, and the means Bob used only works once.

That's the thing. We don't always know. Hence the need to reduce the attack lifetime.

If they don't know they were breached, don't the odds favor the replaced key likewise getting re-stolen immediately?

Yes, but the odds are less than infinite, i.e. the probability is less than 1.0. At least some of such attacks take effort.

I had to get certificates revoked for HeartBleed. :P

Hmmm. This solution still leaves quite a few days a compromised certificate can be used(!).. that's significant.. but I guess it's better than nothing?

An example I experienced was an employee accidentally shipping keys/certs to a vendor in a support dump of a network device.

I had to revoke the certs and in anticipation I pulled together customer support, engineering, legal, various security orgs in the event that revocation would cause outages from cached certs from middle boxes of which there were plenty or other weird b2b setups.

It turned out to be a nothing-burger. None of the browsers or MitM proxies actually did anything with revocation and happily used the revoked certs without even a single warning from tens of millions of end users and system. This was around 2014. Curious if that has changed and if anyone here has tested revocation in a staging environment that has devices that cache certs.