Issuance May Stop — Operator training

Your CA is down for an upgrade. What happens to the ten thousand certificates it already issued? If the answer is "revocation checks start failing", your outage just spread to every relying party you have.

goca is built around a one-line priority: issuance may stop; validation must not. Any replica answers any request; the database is the single stateful component and rides standard PostgreSQL HA. Revocation data is designed as static, pre-signed artifacts, so relying parties keep validating even while the CA core is down or being upgraded. Not being able to mint a new certificate for an hour is an inconvenience; not being able to check the ones that exist is an incident everywhere at once.

Metaphor: a passport office can close for a public holiday; border control cannot.

Where it breaks: border guards can phone the office when unsure. Relying parties must never need to — the artifacts they fetch are pre-signed, with validity long enough to outlive a planned outage.

Now I can say which half of my CA is allowed to go down — and which half never is.