Thoughts from starting to play with ARI

On a per-client basis, I agree with everything you said. My concern is that the majority of clients are not properly designed or coded. The last time I checked the "recommended clients" list (ACME Client Implementations - Let's Encrypt) only a handful even had tests. Clients aren't really tracked, so information is limited (see The most seen ACME client - #25 by eva2000 for some info).

I'm not actually thinking about the impact on the CA. My concern is that end-users will be running clients that implement ARI incorrectly (and without tests), thinking they are fine because they see "Now supporting ARI!". Then their sites go offline during a mass revocation, because their code does not correctly parse or compare dates.

I recall LE had blocked certain clients in the past to protect greater availability. I think there was a firewall block on bitnami, because they did not randomize the runtime and just checked at midnight.

3 Likes