The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate.
But should you do the same if there are no indications that the key is compromised, but you no longer need the certificate? Let's Encrypt certificates will automatically expire after 90 days. Is it enough to delete the certificate and its private key?
As a background, this is my concrete scenario:
- When we deploy new software, it will create new EC2 instances, which will eventually replace the existing instances (immutable server pattern).
- At startup, new instances will acquire a new Let's Encrypt certificate.
- Certificates (and their private keys) never leave the EC2 instance.
So, when old instances are terminated, the certificates assigned to that machine will be destroyed. At this point, we are no longer able to get access to the private key.
- From my understanding, revoking might be a good practice. But strictly speaking, it will not increase the security of the system (of course, assuming that the private key was not compromised). Is that correct?
- Will it help the Let's Encrypt operators to explicitly revoke unused certificates, or will it do more harm? (I'm not sure, but revoking could trigger extra processes, which might be unnecessary if there is no indication of the key being compromised.)