Subject: [Acme] Re: Potential issues with dns-persist-01
From: Shiloh Heurich <[email-masked]>
To: Seo Suchan <[email-masked]>
Cc: [email-masked]
Date: Fri, 17 Apr 2026 09:37:11 -0400
List-Id: Automated Certificate Management Environment <acme.ietf.org>

> On Apr 17, 2026, at 08:09, Seo Suchan <[email-masked]> wrote:
> 
> How hard for an ACME CA to remember every public keys an account was/is tied to?

Not hard to track in a database table; the problem is what it does to revocation.

If old key thumbprints stay valid indefinitely, then key rotation no longer revokes the old key's authority over persistent records. An attacker who compromised a key that was later rotated away can still use dns-persist records containing that key's thumbprint. That's the opposite of what rotation is for.

You could bound it (e.g. accept keys from the last N rotations, or within a time window) but then clients eventually need to update DNS records anyway, and the CA carries the complexity of deciding which old keys are recent enough.