Re:Let's Encrypt: Reliability via Automated Renewal Information
by mholt on Friday March 24, 2023 @03:48PM
(#35294476)
> Some existing systems like the Caddy server use OCSP to detect if a cert is revoked and can renew immediately, but ARI allows allows a certificate to be reissued before the old one is revoked.
Hi Matthew :)
Caddy still serves a perfectly valid "GOOD" response from the OCSP responder while it renews the certificate, so the certificate is good as not-revoked until that OCSP staple expires.
(As we know, revocation is broken anyway. We should deprecate it for public PKI and go with short cert lifetimes instead.)
There are other related things that aren't specifically revocation: For example, certificates contain embedded Certificate Transparency timestamps from CT logs. If one or more of those logs fail, we might want to reissue those certificates before browsers distrust the logs.
(I work for Let's Encrypt)