Feedback on raising Certificates per Registered Domain to enable peer-to-peer networking

Congrats on getting your PSL PR merged!

It will take a little bit of time for that to flow downstream to us (it has to pass through one intermediate repository first, and then we have to update our copy of the PSL, and then we have to deploy that updated code) but hopefully it won't take too long.

I do have a few small suggestions that will help things go smoothly:

  • Ensure that the ACME client you ship attempts to renew at random or jittered times (e.g. not at midnight every night) to avoid contributing to periodic load spikes
  • Ensure that the ACME client you ship supports ARI, so that it can handle automatic replacement without your users needing to intervene in case there is a mass revocation event
  • Ensure that the ACME client you ship can auto-update without your users' intervention, so that future improvements (like support for short-lived certs) can be delivered to your users directly

And finally, remember that we're a public-benefit non-profit, so you can always donate to support the work we do and help keep us runnning: Donate - Let's Encrypt