6 ms·
The CA can't solve it for you. The certificate authority signs certificate requests, creating certificates. The revocation process is necessary as well, but th
by 411111111111111 3y ago
The CA can't solve it for you.
The certificate authority signs certificate requests, creating certificates. The revocation process is necessary as well, but the CA doesn't have the ability to change the already issued certificate, thus it cannot take action.
A software like certbot can solve it for you, but that's not affiliated with your CA
- agwa 3y agoThe CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.
- mcpherrinm 3y agoEven before ARI, some integrated ACME/Web servers use OCSP as a way of knowing to renew if a cert was revoked. Plus if you're doing that you can pin the OCSP response while you're at it.
- 411111111111111 3y agoMy point was that the CA can't solve it for you, they can only give you APIs and processes with which you can solve it yourself. If your webserver supports checking the certificate validity then it's not solved by the CA, it's been solved by the developers of that software and by you installing it.