Certificate Lifecycle Service · View 19 of 21 · Operations
Where most designs draw it wrong
- The common loop closes at 'issue' — request, validate, issue, repeat. That loop has no step that could ever detect an endpoint still serving the old certificate.
- Here the loop cannot close without 'observe serving'. The renewal step reads from observation, so a certificate that never took effect stays due rather than being marked done.
The durable thing
- The identity is permanent and carries the owner, the trust domain and the compromise history. Certificates are perishable and carry only a validity window.
- This is why a key compromise is recorded against the identity: the certificate that held the key will expire on its own and take the record with it.
Assumption
- Renewal triggers at one third of lifetime remaining, deliberately expressed as a fraction so the policy survives the industry shortening maximum certificate lifetimes again.
