Validation Never Sleeps — Operator training

When your CA core is down for an upgrade, what happens to every TLS handshake that checks your CRLs? In goca: nothing. The validation head, valpub, is database-free and key-free. Controllers push complete, verified artifact sets to its ingest listener; a replica becomes ready only after receiving a valid initial set, and from then on it serves signed, pre-built artifacts from what it holds.

That separation is the operational meaning of the product's signature line: issuance may stop; validation must not. Revocation data is designed to be static, pre-signed artifacts precisely so relying parties keep validating while the issuance core is isolated, upgraded, or recovering. A CA that cannot issue for an hour is an inconvenience; a CA whose revocation infrastructure goes dark takes every dependent handshake down with it.

Metaphor: a printed train timetable posted at every station. Head office can burn down; the timetables stay readable.

Where it breaks: a timetable never expires; a CRL does. The posted copy is only good until its nextUpdate — which is why CRL freshness, not core uptime, is the number to alert on.

Now I can explain why validation survives an issuance outage.