4 ms·

So that admins find out that the certificate they have configured is no longer valid.

Asmod4n 2y ago
You’d need a monitoring solution for that, your web server won’t just send you a mail when it’s cert got revoked. The client does that for you, by checking back at the CA. No need for any configuration server side.
mcpherrinm 2y ago
For webservers, our recommendation is that your ACME client queries the ACME Renewal Information endpoint to find out if the certificate needs to be renewed: https://letsencrypt.org/2023/03/23/improving-resliiency-and-reliability-with-ari.html https://letsencrypt.org/2023/03/23/improving-resliiency-and-...
- Arnavion 2y ago
  Does ARI also return a suggested window of "right now" if the queried cert is manually revoked in the past? I was actually wondering this a few months ago when I implemented ARI in my ACME client - I also have a pending task to implement revocation checking, and if the ARI check makes that redundant it would be great. (Both the RFC and the LE blog only talk about querying ARI at some time before the CA decides to revoke the cert. My question is about querying ARI at some time after the user has revoked the cert.)
  - mcpherrinm 2y ago
    Yes, revoked certs will return "right now".
    - Arnavion 2y ago
      That's really nice. Thanks.
eqvinox 2y ago
If your certificate has been revoked and you don't know that (e.g. from a very alarming e-mail), something has seriously gone wrong. In the general case, it'd be yourself requesting the revocation to begin with. But even if it isn't, I'm pretty sure the CA is supposed to tell you expeditiously.
- phasmantistes 2y ago
  Not all subscribers provide email addresses through which they could be informed of a revocation.
- mcpherrinm 2y ago
  Ideally your server handles this automatically, which is why Let’s Encrypt is working on extending ACME to help with this case. Some good implementations of ocsp stapling can already automatically get a new certificate if they receive a “revoked” ocsp response. Requiring humans to read their email and be looped in is work I want to avoid needing at all.

You’d need a monitoring solution for that, your web server won’t just send you a mail when it’s cert got revoked. The client does that for you, by checking back at the CA. No need for any configuration server side.

mcpherrinm 2y ago

For webservers, our recommendation is that your ACME client queries the ACME Renewal Information endpoint to find out if the certificate needs to be renewed: https://letsencrypt.org/2023/03/23/improving-resliiency-and-reliability-with-ari.html https://letsencrypt.org/2023/03/23/improving-resliiency-and-...

Arnavion 2y ago
Does ARI also return a suggested window of "right now" if the queried cert is manually revoked in the past? I was actually wondering this a few months ago when I implemented ARI in my ACME client - I also have a pending task to implement revocation checking, and if the ARI check makes that redundant it would be great. (Both the RFC and the LE blog only talk about querying ARI at some time before the CA decides to revoke the cert. My question is about querying ARI at some time after the user has revoked the cert.)
- mcpherrinm 2y ago
  Yes, revoked certs will return "right now".
  - Arnavion 2y ago
    That's really nice. Thanks.

eqvinox 2y ago

If your certificate has been revoked and you don't know that (e.g. from a very alarming e-mail), something has seriously gone wrong. In the general case, it'd be yourself requesting the revocation to begin with. But even if it isn't, I'm pretty sure the CA is supposed to tell you expeditiously.

phasmantistes 2y ago
Not all subscribers provide email addresses through which they could be informed of a revocation.
mcpherrinm 2y ago
Ideally your server handles this automatically, which is why Let’s Encrypt is working on extending ACME to help with this case. Some good implementations of ocsp stapling can already automatically get a new certificate if they receive a “revoked” ocsp response. Requiring humans to read their email and be looped in is work I want to avoid needing at all.