Revocation Reason Should be Requested

[BenWilson-Mozilla]

Shouldn't Certbot request a reason code (especially for Key Compromise) before submitting a revocation request? My understanding is that default behavior doesn't ask whether the revocation is for key compromise or other reasons. That information should be passed on to the Let's Encrypt CRL.

[osirisinferi]

My understanding is that default behavior doesn't ask whether the revocation is for key compromise or other reasons.

Correct, the default reason is unspecified.

That information should be passed on to the Let's Encrypt CRL.

Users can use the --reason option to e.g. specify --reason keycompromise in combination with the revoke subcommand.

Note that Certbot currently is not affiliated any longer with Let's Encrypt, but is developed by the EFF 🙂

Is your request that Certbot should always ask for a reason, if not provided by the user on the CLI?