TFA gives you a clue why you need to know when all ELBs are updated:
* "However, due to nobody outside of AWS knowing exactly how ELB works, this could just mean that the machines currently responding to the requests are patched, but in the next request, it could hit an unpatched ELB machine."
* "We then wrote to support to hear if it was now safe to re-key the certificates, but did not hear from them for hours."
Summary: You re-key your certificates, thinking you are all good. Now an attacker hits a non-patched ELB, exploits the issue and gets your new keys.
So you pay for revocation of certificates twice. The first time you revoked the certicates, someone could have compromised them immediately afterwards. How is that a good solutions?
Is payment for revocation standard practice? I've reissued and revoked probably a dozen Comodo certs (both directly and via Namecheap as a reseller) without issue.
Comments
TFA gives you a clue why you need to know when all ELBs are updated:
* "However, due to nobody outside of AWS knowing exactly how ELB works, this could just mean that the machines currently responding to the requests are patched, but in the next request, it could hit an unpatched ELB machine."
* "We then wrote to support to hear if it was now safe to re-key the certificates, but did not hear from them for hours."
Summary: You re-key your certificates, thinking you are all good. Now an attacker hits a non-patched ELB, exploits the issue and gets your new keys.
So wait until you see this message: https://aws.amazon.com/security/security-bulletins/heartblee...
and then update your certs again just to be safe.
So you pay for revocation of certificates twice. The first time you revoked the certicates, someone could have compromised them immediately afterwards. How is that a good solutions?
There's not always a perfect solution, gotta work with what you're given.
If you absolutely can't wait for the updated status message then the solution I gave was the only solution.
If the price of the revocation (which my issuer doesn't charge) is too high for your business then your only option is to wait.
Is payment for revocation standard practice? I've reissued and revoked probably a dozen Comodo certs (both directly and via Namecheap as a reseller) without issue.