cpu

Also you're renewing your certs early, based on some proportion of their total validity period right? And using ACME, so it's automated and easy to fail-over to a standard's compliant alternative CA, right?? And using ARI so you're informed when you need to re-issue sooner than expected because of a compliance issue, right??? And back-stopping all of the above with monitoring, right????

@kpcyrd@chaos.social I think when there's a 1/3rd of the lifetime left is a good rule of thumb for when to start trying to renew. 30 days from expiry for a 90 day cert, 2 days out for a 6 day, etc. ARI is defined in https://www.rfc-editor.org/rfc/rfc9773.html We have the guts implemented in instant-acme if you want a rust reference, but it's low level and a full fledged client needs to string together the pieces.

@filippo@abyssdomain.expert @dominik@mastodon.honnef.co This is really cool, and a model that I hope catches on! Thanks for blazing a trail for others to follow.

@rustconf@hachyderm.io No discount tickets for locals this year? That was a nice perk the last time RustConf was in Montreal :'(