3 ms·

They have the physical infrastructure to do so, but you've missed this part of article you linked: > In order to get all those certificates replaced, we need a

They have the physical infrastructure to do so, but you've missed this part of article you linked: > In order to get all those certificates replaced, we need an efficient and automated way to notify ACME clients that they should perform early renewal. Normally ACME clients renew their certificates when one third of their lifetime is remaining, and don’t contact our servers otherwise. We published a draft extension to ACME last year that describes a way for clients to regularly poll ACME servers to find out about early-renewal events. We plan to polish up that draft, implement, and collaborate with clients and large integrators to get it implemented on the client side. Running certbot daily will currently do nothing. It won't think that the certificate needs to be replaced since it has not yet reached the limit required to renew.

mholt 5y ago
> Running certbot daily will currently do nothing. It won't think that the certificate needs to be replaced since it has not yet reached the limit required to renew. Yep, this. Clients need to be built to support it. I know this is from the linked article and not from you, but: > In order to get all those certificates replaced, we need an efficient and automated way to notify ACME clients that they should perform early renewal. This is already possible. It's called OCSP stapling, and it's what Caddy (and CertMagic) does by default, automatically. When Caddy sees from OCSP that the certificate is revoked, it will automatically replace it.
- benburwell 5y ago
  Wouldn't clients then only become aware that they need to replace their certs after they've been revoked? I think the desire here would be for a mechanism to alert clients to obtain a new certificate before their current certificate is revoked and becomes invalid. edit: formatting
  - mholt 5y ago
    > Wouldn't clients then only become aware that they need to replace their certs after they've been revoked? A certificate that is going to be revoked is as good as revoked. There is no "almost untrusted, but not quite yet" gray area (unless you're talking about expiration dates, which some browsers allow leniency on; but we're talking about revocation, where we know there was a problem or misissuance, whereas expiration is mainly a passive safeguard against indefinite trust). So, once a client sees a "Revoked" OCSP status, it can replace the certificate immediately, before the previous, valid OCSP response expires.

mholt 5y ago

> Running certbot daily will currently do nothing. It won't think that the certificate needs to be replaced since it has not yet reached the limit required to renew. Yep, this. Clients need to be built to support it. I know this is from the linked article and not from you, but: > In order to get all those certificates replaced, we need an efficient and automated way to notify ACME clients that they should perform early renewal. This is already possible. It's called OCSP stapling, and it's what Caddy (and CertMagic) does by default, automatically. When Caddy sees from OCSP that the certificate is revoked, it will automatically replace it.

benburwell 5y ago
Wouldn't clients then only become aware that they need to replace their certs after they've been revoked? I think the desire here would be for a mechanism to alert clients to obtain a new certificate before their current certificate is revoked and becomes invalid. edit: formatting
- mholt 5y ago
  > Wouldn't clients then only become aware that they need to replace their certs after they've been revoked? A certificate that is going to be revoked is as good as revoked. There is no "almost untrusted, but not quite yet" gray area (unless you're talking about expiration dates, which some browsers allow leniency on; but we're talking about revocation, where we know there was a problem or misissuance, whereas expiration is mainly a passive safeguard against indefinite trust). So, once a client sees a "Revoked" OCSP status, it can replace the certificate immediately, before the previous, valid OCSP response expires.