# OCSP stapling refresh times

**URL:** <https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458>\
**Category:** Issuance Policy\
**Created:** [August 9, 2021, 9:43pm UTC](https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458 "2021-08-09T21:43:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![derschultz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/derschultz/32/51816_2.png) [@derschultz](https://community.letsencrypt.org/u/derschultz)\
**Post date:** [August 9, 2021, 9:43pm UTC](https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458/1 "2021-08-09T21:43:22Z")

</div>

How often does Let's Encrypt update stapling data for the certs it signs? Based on certs I have provisioned from Let's Encrypt, I see that stapling data is updated roughly every 3 days and lasts for 7 days. Is this correct?

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [August 9, 2021, 10:24pm UTC](https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458/2 "2021-08-09T22:24:42Z")

</div>

I think the only "promise" about OCSP timing are the constraints listed in the Certificate Policy, section 4.9.10

> **[ISRG CP v3.0 - Let's Encrypt](https://letsencrypt.org/documents/isrg-cp-v3.0/#4.9.10-on-line-revocation-checking-requirements)**
>
> ISRG CP v3.0

> 1. OCSP responses MUST have a validity interval greater than or equal to eight hours;
> 2. OCSP responses MUST have a validity interval less than or equal to ten days;
> 3. For OCSP responses with validity intervals less than sixteen hours, then the CA SHALL update the information provided via an Online Certificate Status Protocol prior to one-half of the validity period before the nextUpdate.
> 4. For OCSP responses with validity intervals greater than or equal to sixteen hours, then the CA SHALL update the information provided via an Online Certificate Status Protocol at least eight hours prior to the nextUpdate, and no later than four days after the thisUpdate.

But I think the times you're seeing, of 7-day-signing updated every 3 days, are "typical".

I am _really_ far from being an expert, or even being an informed amateur, on OCSP, though.

Dare I ask, what you're planning on doing with this information? I _thought_ that OCSP responses included information on when to expect a next update.

---

<div class="post-metadata">

**Author:** ![derschultz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/derschultz/32/51816_2.png) [@derschultz](https://community.letsencrypt.org/u/derschultz)\
**Post date:** [August 10, 2021, 2:26am UTC](https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458/3 "2021-08-10T02:26:54Z")

</div>

Thanks for the response! I'm interested in the cadence at which stapling data is created because I work with some software that uses the stapling data, and would like to know how often I should expect to see that stapling data change.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 9, 2021, 2:27am UTC](https://community.letsencrypt.org/t/ocsp-stapling-refresh-times/157458/4 "2021-09-09T02:27:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.