# Improving revocation : will Let's Encrypt support OCSP Must-staple? **URL:** \ **Category:** Feature Requests\ **Created:** [November 23, 2015, 7:11pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334 "2015-11-23T19:11:59Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [March 31, 2016, 8:04pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/21 "2016-03-31T20:04:33Z")
@osiris: This bug is now fixed on staging. Please try again. ---
**Author:** ![tdelmas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tdelmas/32/1866_2.png) [@tdelmas](https://community.letsencrypt.org/u/tdelmas)\ **Post date:** [April 2, 2016, 4:45pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/22 "2016-04-02T16:45:37Z")
@jsha Hi, is the must-staple feature in production yet ? > [@jsha](#): > > We'll probably enable it in production sometime Thursday. And if anyone know : [How to simply check if a certificate has the OCSP must-staple attribute? - Information Security Stack Exchange](http://security.stackexchange.com/questions/119316/how-to-simply-check-if-a-certificate-has-the-ocsp-must-staple-attribute) ? ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [April 2, 2016, 6:58pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/23 "2016-04-02T18:58:24Z")
Not yet, sorry. Our Ops team has been busy. ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 6, 2016, 4:36pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/24 "2016-04-06T16:36:14Z")
Hi i found two points: 1. I added an new DNS record for the test. But the server (staging) toggle between the old IP and the new one. Even old and new one had an DNS TTL of 60sec. 2. The CSR i Generated always cause an Internal Server Error on the acme side. Any hints ? CSR: MIIBUzCB1wIBADAZMRcwFQYDVQQDEw50ZXN0LnN1Y2hlLm9yZzB2MBAGByqGSM49AgEGBSuBBAAiA2IABMZFTHnwtatfYkVTMTnqupRt6Ue/jcfCukBRPav35LrVJJ4Kr/Pvlk3YXTrbN7n0Tv8yp0atfLleqUBShoLbR/0jQkcKIpj4sTO9FN+onu5v9tuzyBv6iWLq87mepCK63aA/MD0GCSqGSIb3DQEJDjEwMC4wEQYIKwYBBQUHARgEBTADAgEFMBkGA1UdEQQSMBCCDnRlc3Quc3VjaGUub3JnMAwGCCqGSM49BAMCBQADaQAwZgIxAOiqqRhDw1WBwYJQXeNYthuun3r057/bc2PeitdHH/ZX8xOeVwDOtSfojUoeCOlZYQIxAKyT+qJ4i1RgTf+7E6L1xWsV/lKJRss+hmLzLgzPKZBNoSmDPmIR/eAoLZYTMoc+7g== > {"header": {"alg":"ES384","jwk":{"crv":"P-384","kty":"EC","x":"cB\_MZcEEBpJnyKSj-za2rOSpOCO69Rtl1-tiQpHd4hReav96b4k71jRmYPZg6r5G","y":"\_CRvh6A4OdQivpAkUGUfTuO84ZnLsDbgPpIxKVBXIYxE--Gi65IjOhypqdjG-fFE"}}, "protected": "eyJub25jZSI6ICJsZUk2UmxPOHhDNnMwb1l1b1VHWnhnU0UyMUp3NnFBU3pRZVFvWHFqLTUwIn0", "payload": "eyJyZXNvdXJjZSI6ICJuZXctY2VydCIsICJjc3IiOiAiTUlJQlV6Q0Ixd0lCQURBWk1SY3dGUVlEVlFRREV3NTBaWE4wTG5OMVkyaGxMbTl5WnpCMk1CQUdCeXFHU000OUFnRUdCU3VCQkFBaUEySUFCTVpGVEhud3RhdGZZa1ZUTVRucXVwUnQ2VWVfamNmQ3VrQlJQYXYzNUxyVkpKNEtyX1B2bGszWVhUcmJON24wVHY4eXAwYXRmTGxlcVVCU2hvTGJSXzBqUWtjS0lwajRzVE85Rk4tb251NXY5dHV6eUJ2NmlXTHE4N21lcENLNjNhQV9NRDBHQ1NxR1NJYjNEUUVKRGpFd01DNHdFUVlJS3dZQkJRVUhBUmdFQlRBREFnRUZNQmtHQTFVZEVRUVNNQkNDRG5SbGMzUXVjM1ZqYUdVdWIzSm5NQXdHQ0NxR1NNNDlCQU1DQlFBRGFRQXdaZ0l4QU9pcXFSaER3MVdCd1lKUVhlTll0aHV1bjNyMDU3X2JjMlBlaXRkSEhfWlg4eE9lVndET3RTZm9qVW9lQ09sWllRSXhBS3lULXFKNGkxUmdUZi03RTZMMXhXc1ZfbEtKUnNzLWhtTHpMZ3pQS1pCTm9TbURQbUlSX2VBb0xaWVRNb2MtN2cifQ", "signature": "v1-sVVtyp5GgT9jIlnLW3vX1MLhqSrzur45-aIOznq1gW1GURG8Rjb0BdIEMxoVAall-TitPpTDLk1TUp1yFKZh1MiLamjYb3UnodU1I1AOezd-ISFd005e6MFI\_AdX9"} > 391 ms POST [https://acme-staging.api.letsencrypt.org/acme/new-cert](https://acme-staging.api.letsencrypt.org/acme/new-cert) HTTP-500 Internal Server Error {"type":"urn:acme:error:serverInternal","detail":"Error creating new cert","status":500} > 2016-04-06T18:32:50.205 INFO REQ-LOG (127.0.0.1 , 101700) ZIP( -1 \< 669) in 11551(ms) for[200] GET [https://127.0.0.1/acmeAdmin](https://127.0.0.1/acmeAdmin) CipherSuite(TLS\_ECDHE\_ECDSA\_WITH\_CHACHA20\_POLY1305\_SHA256) param:{"acmeServer":["[https://acme-staging.api.letsencrypt.org/directory"],"addFQDN":["test.suche.org"],"keyLen":["384"],"keyTyp":["EC](https://acme-staging.api.letsencrypt.org/directory%22%5D,%22addFQDN%22:%5B%22test.suche.org%22%5D,%22keyLen%22:%5B%22384%22%5D,%22keyTyp%22:%5B%22EC)"]} ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 6, 2016, 8:38pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/25 "2016-04-06T20:38:09Z")
Very strange… I can get a RSA public key certificate **with** the must-staple feature, but when I use an ECDSA key (with must-staple), it malfunctions…? ECDSA itself is _not_ the problem, but the combination ECDSA and Must-Staple is… Unfortunately, an internal server error is hard to debug… Could it be this line? [https://github.com/letsencrypt/boulder/blob/master/ra/registration-authority.go#L590](https://github.com/letsencrypt/boulder/blob/master/ra/registration-authority.go#L590) ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 7, 2016, 7:19pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/26 "2016-04-07T19:19:12Z")
@Osiris should i fill an bug ticket for this ? Since you can reproduce it. It should not be an fault on my implementation. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 7, 2016, 7:20pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/27 "2016-04-07T19:20:00Z")
Already done ;)  ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 7, 2016, 8:52pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/28 "2016-04-07T20:52:38Z")
Osiris opened the bug 1706 with an good description > Summary: This feature was not supported in the ECDSA profile. Should be supported on production if it go live. Attention: currently only OCSP-Staple is allowed as supported feature by 1.3.6.1.5.5.7.1.24. ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 11, 2016, 8:21am UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/29 "2016-04-11T08:21:10Z")
Hi, any timeline when the EC fix will be available for testing in staging environment? ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [April 12, 2016, 5:13am UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/30 "2016-04-12T05:13:48Z")
This is now fixed in staging. You should be able to issue ECDSA + Must-Staple certificates against staging. ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 12, 2016, 6:05am UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/31 "2016-04-12T06:05:20Z")
Nice 😁 I can confirm that it is now working. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [April 21, 2016, 5:22pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/32 "2016-04-21T17:22:54Z")
Sorry for the delay on this, all. We realized that our [CP](https://letsencrypt.org/repository/) doesn’t currently list the Must Staple extension as one of the ones we may provide in certificates. We need to update the CP before we can flip on the config. That’s taken a little longer than expected because the necessary staff members have been quite busy. Will post again once we’re able to turn it on. Thanks, Jacob ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [April 27, 2016, 6:08pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/33 "2016-04-27T18:08:39Z")
OK we will wait. Will i hope that this will not be an long term feature. If there is no time frame mentioned yet. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 27, 2016, 8:02pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/34 "2016-04-27T20:02:19Z")
You "should" also update your CPS: > keyUsage. This extension is present and marked critical. Bit positions for digitalSignature and > keyEncipherment are set But `keyEncipherment` isn't set for ECDSA certificates: > [@ECDSA testing on staging](https://community.letsencrypt.org/t/ecdsa-testing-on-staging/8809/57): > > S… Might wanna look into that 🙂 Actually, from reading the CP, the CPS is the most logical choice to put the TLS Feature Extension too I think. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [April 27, 2016, 8:13pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/35 "2016-04-27T20:13:14Z")
Thanks for pointing that out! I’ll work on it. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [May 1, 2016, 12:02pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/36 "2016-05-01T12:02:16Z")
@jsha: This probably is going to take some time I assume? Lawyers and stuff…? I also assume it isn’t worth waiting on a cert I’d want to issue with Must-Staple, which is expiring in 10 days, right? 😛 ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [May 2, 2016, 4:05pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/37 "2016-05-02T16:05:28Z")
Updating the CP / CPS doesn’t require lawyers, but it requires approval from various people. It should happen soon but I definitely wouldn’t recommend waiting to issue a certificate that is expiring so soon! You can always issue again afterwards. That won’t have the nice revocability properties you probably want, but the next round will. You can plan on spending the next 60 days finding stapling bugs in your web server. 🙂 ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [May 3, 2016, 1:39pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/38 "2016-05-03T13:39:48Z")
Ah cool an timeline, so next ask in two months. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [May 24, 2016, 2:18am UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/39 "2016-05-24T02:18:46Z")
Must Staple is now live in production. You can use the new `--must-staple` flag in certbot if you build from master, or you can use the manual CSR method. Enjoy! ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [May 24, 2016, 8:15pm UTC](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/40 "2016-05-24T20:15:17Z")
Great if works ([suche.org](https://suche.org/)) Even with ECDSA 🙂 So is the CP /CPS also been updated right now ? [Previous page](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334.md?page=1) [Next page](https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334.md?page=3)