Certificate Lifecycle Service · View 15 of 21 · Runtime
The ordering decision
- Re-issue precedes revoke. Revoking first turns a compromise notice into a self-inflicted outage across every affected endpoint.
- For a key known to be in an attacker's hands, the order inverts and the outage is accepted — and that inversion is a declared decision with an approver, not an improvisation.
Capacity is a designed number
- Bulk re-issuance of the full public-trust population: ≤ 18 hours, sized to complete inside a 24-hour deadline with margin (stated assumption).
- Revocation published and observed by all validating endpoints: ≤ 5 minutes p95, ≤ 15 minutes p99, measured by a daily synthetic canary rather than assumed.
- The bulk path is rehearsed twice a year against a representative subset. An unrehearsed bulk path is an untested one.
Risk
- Two-person control on bulk operations exists because the failure mode of this flow is revoking certificates that should not have been revoked, at scale, quickly.
- Revocation checking is soft-fail in most browsers. The platform declares a posture per relying-party class; an undeclared class is treated as a defect.
