Post #2266668
2026-05-08 21:02 UTC
Reminder that halting issuance is a recommended action during an incident & trustworthy CAs will do it early, until the problem is conclusively identified and remediated.
This happens for both for true "oh-shit" events, and "cross your t's dot your i's" compliance issues and you can't infer which bucket the incident is in just because issuance has stopped.
See
https://wiki.mozilla.org/CA/Responding_To_An_Incident#Immediate_Actions
Replies (1)
-
@cpu@hachyderm.io 2026-05-08 21:06
Also you're renewing your certs early, based on some proportion of their total validity period right? And using ACME, so it's automated and easy to fail-over to a standard's compliant alternative CA, right?? And using ARI so you're informed when you need to re-issue sooner than expected because of a compliance issue, right??? And back-stopping all of the above with monitoring, right????