Last days I was a little bit nervous. 3,048,289 Letsencrypt certificates to revoke. Checked the file, some accounts with thousands of certificates that must be renewed. What happens if a webmaster is on vacation?
Revoked certificates can kill a business. Https is great, same https everywhere. There is no step back to http. But a not working website is critical. The bug is not good. But there was a correct cached authorization.
This morning - oh:
First informations Tuesday, now 1,706,505 certificates renewed. Client-initiated. So Letsencrypt can revoke these certificates without a website crash.
This evening. May be the next 500.000 - 1.000.000 certificates are renewed. So it’s possible to revoke these certificates.
So: Thanks! Websites and users are happy. The rule is broken, but the effect is helpful.
Is this rule - revoke all certificates in 5 days - really good?
The certificate authority must:
- identify the certificates, a list should be created
- may be an online tool is required ( https://checkhost.unboundtest.com/ )
- a mass mailing is required
That needs some time. There were users, Tuesday, 16:00 - no mail, not affected. 20:00 - oh, a mail - affected.
Users need some time to check their configuration and to renew the certificates.
So my idea: A splitted rule.
- The CA has 3 or 4 days to identify the certificates and to send a mass mailing.
- Users should have 3 days to renew their certificates
- After 6 or 7 days all affected certificates must be revoked.
Not 5, instead 6 or 7 days.