> I can understand if CF didn't prioritize it enough to spend development resources on revoking a cert but I don't see an upside for CF to continue keeping the

> I can understand if CF didn't prioritize it enough to spend development resources on revoking a cert but I don't see an upside for CF to continue keeping the certificate after a customer exits. We have no idea if cloudflare retained the cert. The blog post is just claiming that cloudflare did not revoke the certificate and instead is just letting it expire naturally. (That said, i wouldn't be surprised if they retained it) Potential upside for cloudflare is that if the client disabled ddos protection just temporarily to test something but intends to reenable it, this allows the reenable to happen instantly (assuming they kept the cert).