Guide to best practices for ACME clients

Good point, although honestly, in years of practice I have never known of substantial benefits from this -- or heard even one request/complaint about this. For example, a CDN with 100 names on a cert could in theory benefit if the client happens to visit many of those sites but usually the names on the cert are not related, and if they are, the client might only visit a couple of them. So we're talking a time savings of a few ms every few minutes. It definitely can be an optimization, but it's a niche one to be sure.

I like this idea. It's interesting how prophetic but that issue and this doc were in the case of the recent LE bug (by pure chance, of course -- which also extends to single-SAN certs by the way!). In fact, we've since proven this advice by experience, as Caddy/CertMagic were (AFAIK?) the only clients guaranteed to be unaffected by the CAA rechecking bug (first, because they are not multi-SAN certs, and second, even if they were affected, Caddy/CertMagic would renew the impacted certificate before the Valid staple expired).

There is at least one caveat, and that is some clients don't honor OCSP staples over their own revocation lists. For example, Safari (I think?) -- actually, Apple as a vendor -- dispatches their own revocation lists to their clients, and I believe they receive priority over a signed and stapled OCSP response, even! But yes, definitely if the server is watching the OCSP status and finds a revocation, doing an immediate replacement should at least minimize that window if there is one at all. I'd be surprised if a period check every few hours was that much faster than Apple's propagation speed.

Also a good point -- pending the caveat noted above -- but would you mind opening an issue/PR to suggest it? We can at least discuss it.

Thanks for your feedback!

1 Like