4 ms·
This is a valid request, right? You'd claim that you've withdrawn permission from CF (not that the key was compromised). Looking at this RFC: https://datatracke
by 8organicbits 2y ago
This is a valid request, right? You'd claim that you've withdrawn permission from CF (not that the key was compromised). Looking at this RFC: https://datatracker.ietf.org/doc/html/rfc5280 https://datatracker.ietf.org/doc/html/rfc5280
And CF has no obligation to revoke the cert when it's no longer needed, nor to act as a free middleman between domain owner and CA.
- aaomidi 2y agoCF does “technically” have that obligation under many subscriber agreements. Cloudflare could make this much easier by revoking the cert when the customer moves away from them. They probably should do this.