3 ms·
That's not my take. He's just saying that the linked document states > If your CA will not be revoking the certificates within the time period required by th
by nebulous1 5y ago
That's not my take. He's just saying that the linked document states
> If your CA will not be revoking the certificates within the time period required by the BRs, our expectations are that:
> The decision and rationale for delaying revocation will be disclosed to Mozilla in the form of a preliminary incident report immediately; preferably before the BR-mandated revocation deadline. The rationale must include an explanation for why the situation is exceptional. Responses similar to “we do not deem this non-compliant certificate to be a security risk” are not acceptable. When revocation is delayed at the request of specific Subscribers, the rationale must be provided on a per-Subscriber basis.
However, letsencrypt's report neglected to do any of this, so he queried them on this