Hacker News Reader

The CA can't solve it for you.

The certificate authority signs certificate requests, creating certificates. The revocation process is necessary as well, but the CA doesn't have the ability to change the already issued certificate, thus it cannot take action.

A software like certbot can solve it for you, but that's not affiliated with your CA

View on HN

The CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.

Even before ARI, some integrated ACME/Web servers use OCSP as a way of knowing to renew if a cert was revoked. Plus if you're doing that you can pin the OCSP response while you're at it.

My point was that the CA can't solve it for you, they can only give you APIs and processes with which you can solve it yourself.

If your webserver supports checking the certificate validity then it's not solved by the CA, it's been solved by the developers of that software and by you installing it.

Reply on news.ycombinator.com