3 ms·
> ACME in fact supports this, and I expect at some point CAs will be required to support it. If you use ACME to get a certificate from CA1, then you can use AC
by throw0101b 3y ago
> ACME in fact supports this, and I expect at some point CAs will be required to support it.
If you use ACME to get a certificate from CA1, then you can use ACME to revoke the same certificate from CA1.
But if the cert was issued from CA2 (via ACME or otherwise), there is nothing you can do about it. And even if the 'rogue' cert was also issued from CA1 as well (but under a different account), unless you have the private there is nothing you can do to revoke it; only perhaps get a completely new cert that 'supersedes' it.
- agwa 3y agoNo, ACME allows you to revoke a certificate if you can successfully complete a challenge for every domain in the certificate (see https://www.rfc-editor.org/rfc/rfc8555#section-7.6 https://www.rfc-editor.org/rfc/rfc8555#section-7.6 "an account that holds authorizations for all of the identifiers in the certificate"). The certificate need not be issued from the same account. Once root programs require all CAs to support ACME, then all you need for automatic revocation is a mapping from CA to ACME directory URL (this could perhaps be disclosed through the CCADB).