The non-profit certificate authority Let's Encrypt, community-driven and providing certificates free of charge to anyone interested, announced the implementation of ARI (ACME Renewal Information) support in its infrastructure. This extension of the ACME protocol allows the transmission of information to clients about the need to renew certificates and recommends the optimal time for renewal. The ARI specification is currently undergoing the standardization process by the IETF (Internet Engineering Task Force), which focuses on the development of protocols and internet architecture, and is in the draft verification stage.
Before ARI was implemented, the client determined the certificate renewal policy themselves, e.g., periodically running the renewal process through Cron or making decisions based on the certificate's lifespan analysis. This approach led to challenges when it became necessary to revoke certificates prematurely; for example, users had to be contacted via email and forced to perform a manual update.
The ARI extension allows the client to specify the recommended certificate renewal time, detach from the 90-day certificate lifespan, and not worry about missing an unexpected certificate revocation. For instance, in the case of an early revocation through ARI, renewal could be initiated not after 90 days but after 60 days. Additionally, ARI enables effective load balancing on Let's Encrypt infrastructure when selecting the timing for renewal. servers GET https://example.com/acme/renewal-info/ "suggestedWindow": { "start": "2023-03-27T00:00:00Z", "end": "2023-03-29T00:00:00Z" },
Source: opennet.ru
