Try it now. The certificate profile validator and Markdown CPS generator are live at https://infrared.turbolightsolutions.com/profile. Pick an example, press Validate, and see a profile mismatch caught before issuance.

In the past year, one CA revoked tens of millions of certificates for one reason. Those certificates passed every industry-standard linter, but they still disagreed with the CA’s own policy document. A second CA hit the same class of defect twice in one month. A third CA was called out for this error in its distrust announcement. The linters that CAs run check certificates against the public standards, such as RFC 5280 and the Baseline Requirements. None of them read the CA’s own policy document. So nothing caught these cases until a third-party researcher filed a report and the five-day revocation clock started.

A CA’s certificate profile exists in at least three places: the policy documents (CP/CPS) that describes it in prose, the CA software configuration that actually produces certificates, and in user-facing product documentation. Those artifacts are maintained separately, usually by different teams, and nothing forces them to agree.

Software engineering named this problem decades ago. “Don’t Repeat Yourself” is the rule that every piece of knowledge must have a single, authoritative representation within a system. If information is duplicated, it will eventually be changed in one place and not the others, and the copies will silently disagree. But what happens when they do disagree?