Hacker News Reader

The CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.

Even before ARI, some integrated ACME/Web servers use OCSP as a way of knowing to renew if a cert was revoked. Plus if you're doing that you can pin the OCSP response while you're at it.

My point was that the CA can't solve it for you, they can only give you APIs and processes with which you can solve it yourself.

If your webserver supports checking the certificate validity then it's not solved by the CA, it's been solved by the developers of that software and by you installing it.

Reply on news.ycombinator.com