Is Let's Encrypt really going to break OCSP Must-Staple? I just got an email alerting me to reissue any Must-Staple certificates by May 7th. OCSC with Must-Staple is the only way revocation isn't broken. I have perfectly functional revocation support right now. Why must I disable it?

Please see the links mentioned in the mail: [image] Ending OCSP Support in 2025 Earlier this year we announced our intent to provide certificate revocation information exclusively via Certificate Revocation Lists (CRLs), ending support for providing certificate revocation information vi…

I wish to point out that this decision is bad, as it proposes to improve the revocation situation by making my revocation system work less well.

Hi Xan, We know that this change is disappointing to some people, and that it can appear to be a step backwards for folks who have properly configured Must-Staple. But there's a difference between that and a "bad" decision -- one has to take many perspectives into account and weigh them against eac…

Thanks for the reply, Aaron. You're right that "bad" was overstating it. But it's definitely true that this is a significant downgrade for my situation. That said, resources are finite, and you can't please everyone all the time. Thanks for the service!

I agree, OCSP stapling (with Must-Staple) is an excellent way to enforce revocation. Unfortunately, [image] Xan: perfectly functional revocation support is an illusion because revocation is fundamentally broken. Ultimately, it's a cost-savings measure for Let's Encrypt, and the introductio…

In what way is revocation broken when using Must-Staple? (I mean, before May 7 when it gets broken on purpose.)

Because clients often still ignore the OCSP staple. :man_shrugging: Many clients prefer to lean on CRLs only these days, commanding their own revocations, which is unfortunate.

I didn't realize Chrome still didn't support it. Sheesh. So you're right! What's frustrating is the amount of work it took to get it working properly: I had to write a daemon to fetch the OCSP responses and put them in the right place for nginx to find them, because nginx wasn't able to handle it…

Is it possible to keep OCSP only for LE certs with must-staple (i.e. put OCSP URLs and handle OCSP requests only for such certs)? Not sure if standards allow such situation but probably would decrease OCSP traffic and resolve privacy issues.

Hi Could you explain me how i must do to disable OCSP must staple? Thank you

OCSP Must-Staple breaking

Issuance Tech

Topic		Replies	Views
Let’s Encrypt to End Support for Online Certificate Status Protocol (OCSP) Help	6	366	December 17, 2024
What will happen to Must-Staple Issuance Policy	32	3871	July 27, 2024
Sunsetting of OCSP in favor of older technology? Issuance Policy	23	3291	August 1, 2024
Modest Proposal for Preserving OCSP Issuance Policy	13	636	August 19, 2024
Requesting feedback on a draft email for subscribers currently using OCSP must-staple Site Feedback	25	986	February 18, 2025

OCSP Must-Staple breaking

Related topics