@patch-work : Welcome to the community.
Woah!! So lots of folks have posted in this thread and their contributions are extremely valid. There's lots of experience here and I want to acknowledge that, especially from longtime leaders like @petercooperjr and @MikeMcQ and @Osiris (The Good Doctor) and more...
That said, I think the thread has started to drift into other areas that don't really focus on the actual concern of the title. "A plea to extend Let's Encrypt support for OCSP"
Topics like "downtime", "DNS propagation delays", "registrar behavior" (OMG)... these are real issues, but they're separate discussions and they should not be in this thread. They should live in their own threads and many of them are not in the scope of this forum.
So I'd like to bring this back to the original point.
If you're dealing with this change and you want to stay focused on the real technical shift, and the end of "must-staple" certificates, My response below is intended to address exactly that.
Take a hard look at your Acme clients or client, whichever, and how you're requesting certificates. If you're still trying to request "must-staple", you're going to hit a wall. Can't avoid it. But your vhost certificate config, including OSCP stapling, that can stay.
It's still valid and useful. It's just not required anymore.
So let's stay on track and try to resolve the issue you mentioned in the title of this thread and that's what the thread and forum are meant for:
I see your point, and I get it. But it's important to separate two things that are now often confused by experienced system administrators and novices alike. It's a fact that needs to be addressed in many cases.
Requesting "must-staple" certificates from Let's Encrypt via ACME clients like Certbot, acme.sh, or any of the other multiple clients is no longer going to happen. It's just not possible. You'll get an exception error, a 403, maybe some kind of unauthorized response or something. Whatever the case is, your script or client will fail, and the cert will not be issued.
Let's Encrypt discontinued support for this feature, and they've announced it long in advance. They've "drawn the line in the sand". No more certs with the TLS feature extension that require stapled OCSP responses. That's it. That's just the way it is, and we have to accept it, deal with it, and just move forward.
On the other hand, using OCSP stapling in your server configuration for Apache, NGINX, Lighttpd, whatever server you choose is still completely valid, and there's nothing wrong with it. It does not violate best practices, and it will work. I'm doing it myself, and I'm very happy with the results. Your mileage may vary depending on your configuration. And of course, this is not an "Web-Server" configuration forum, but we're talking about certificates here, so I think this is appropriate.
The only difference now is that the certificate you're stapling no longer has the "Must-Staple" flag.
It's important to note that and that's perfectly fine. There's nothing wrong with it. There's nothing broken. Nothing to fix. You can still staple OCSP responses to your TLS handshakes if you want. It's up to you. It's just not mandatory or enforced by the certificate anymore.
So, of course, you can staple OCSP... You just can't require it when you're using your client to request a certificate. That's an important point, and that's where Let's Encrypt has made the change and "drawn the line" and opted to discontinue the feature.
Even if you try to require it... and this is an important note...most browsers don't care. They ignore it anyway. They don't pay attention. Chrome, Edge, Safari, Opera, whatever browser you're using... or one of your clients, even someone coming from the outside that you may or may not know... none of them consistently enforce "Must-Staple" anymore. It's just not happening.
So, in reality, you're not going to gain any meaningful security guarantees or advantages from the "Must-Staple" feature. That's why Let's Encrypt pulled the plug. It wasn't providing real-world value, and it just added complexity and unnecessary overhead. They decided to discontinue it, and that's their decision. It worked.
So, if OCSP stapling makes sense in your setup and you want to keep doing it, there's nothing wrong with that. It's perfect. It's a good decision. I do it. Go ahead and do it. It's good to do. It's not going to break anything.
But if your clients (and I'm hoping they're automated) are still trying to request "Must-Staple" certs from Let's Encrypt, they're going to fail. Quickly and utterly. It's just not going to work. Flat out... it's not the thing to do anymore.
So, do a reset. Let's make stuff work and make your system secure. That's the point.
The goal... the real solution:
Get rid of "Must-Staple" requests from your ACME clients that are trying to get OCSP Must-Staple certs.
Leave your virtual host configurations the way they are. They will work.
Then, the problem will be resolved, and the end result will not break your customersâ, clientsâ, or visitorsâ ability to visit your stuff or take in your services or enjoy your sites.
I did not this intend to become a "book". My apologies. I have experienced many of the same emotions/feelings relating to this subject.
Best to you all.
This is my "two cents"
Go figure.
RIP ;@)
