Hacker News Reader

Comment by iso8859-1 | Hacker News Reader

So that admins find out that the certificate they have configured is no longer valid.

For webservers, our recommendation is that your ACME client queries the ACME Renewal Information endpoint to find out if the certificate needs to be renewed:

https://letsencrypt.org/2023/03/23/improving-resliiency-and-...

Does ARI also return a suggested window of "right now" if the queried cert is manually revoked in the past? I was actually wondering this a few months ago when I implemented ARI in my ACME client - I also have a pending task to implement revocation checking, and if the ARI check makes that redundant it would be great. (Both the RFC and the LE blog only talk about querying ARI at some time before the CA decides to revoke the cert. My question is about querying ARI at some time after the user has revoked the cert.)

Yes, revoked certs will return "right now".

That's really nice. Thanks.

If your certificate has been revoked and you don't know that (e.g. from a very alarming e-mail), something has seriously gone wrong. In the general case, it'd be yourself requesting the revocation to begin with. But even if it isn't, I'm pretty sure the CA is supposed to tell you expeditiously.

Not all subscribers provide email addresses through which they could be informed of a revocation.

Ideally your server handles this automatically, which is why Let’s Encrypt is working on extending ACME to help with this case.

Some good implementations of ocsp stapling can already automatically get a new certificate if they receive a “revoked” ocsp response.

Requiring humans to read their email and be looped in is work I want to avoid needing at all.

You’d need a monitoring solution for that, your web server won’t just send you a mail when it’s cert got revoked.

The client does that for you, by checking back at the CA. No need for any configuration server side.

Reply on news.ycombinator.com