Nothing says when the certificate endpoint stops deferring to the old answerer #5

New Issue

2026-09-21T07:18:03Z

cgalo5758 commented

2026-09-21 07:18:03 +00:00

What a contributor runs into

The endpoint the proxy asks before issuing a certificate answers yes in two different situations while the fallback to the legacy answerer is configured: the registry holds a servable placement for the domain, or the legacy answerer said yes. A reader of the response cannot tell which, so the endpoint cannot be used as evidence that the registry knows about a domain, and a test written against it proves less than it appears to.

Why it costs

The ambiguity is a migration-window cost that was accepted when the registry took the endpoint over, and it disappears when the fallback is removed. Nothing records when that is, so the window stays open by default and every later reader has to rediscover why a yes is not a yes.

Where

The domains ask handler and the configuration knob that names the legacy answerer.

Done when

Either the fallback is removed and the endpoint answers from the registry alone, or the configuration that enables it carries the condition for turning it off and something checks that condition.

Migrated from status/issues.md at b7a0e15

## What a contributor runs into The endpoint the proxy asks before issuing a certificate answers yes in two different situations while the fallback to the legacy answerer is configured: the registry holds a servable placement for the domain, or the legacy answerer said yes. A reader of the response cannot tell which, so the endpoint cannot be used as evidence that the registry knows about a domain, and a test written against it proves less than it appears to. ## Why it costs The ambiguity is a migration-window cost that was accepted when the registry took the endpoint over, and it disappears when the fallback is removed. Nothing records when that is, so the window stays open by default and every later reader has to rediscover why a yes is not a yes. ## Where The domains ask handler and the configuration knob that names the legacy answerer. ## Done when Either the fallback is removed and the endpoint answers from the registry alone, or the configuration that enables it carries the condition for turning it off and something checks that condition. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

debt

area/domains area/ops labels 2026-09-21 07:18:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#5