3 ms·
The CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.
by agwa 3y ago
The CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.
- mcpherrinm 3y agoEven before ARI, some integrated ACME/Web servers use OCSP as a way of knowing to renew if a cert was revoked. Plus if you're doing that you can pin the OCSP response while you're at it.
- 411111111111111 3y agoMy point was that the CA can't solve it for you, they can only give you APIs and processes with which you can solve it yourself. If your webserver supports checking the certificate validity then it's not solved by the CA, it's been solved by the developers of that software and by you installing it.