Sha256(or other algorithm) support for certbot ocsp validation

I believe Let's Encrypt (and other CAs) are implementing the so called lightweight OCSP profile from RFC 5019. Thus Certbot is "limited" by what OCSP profiles are implemented by CAs.

The usage of SHA1 with regard to Let's Encrypt has been discussed earlier, see OCSP Responder support for SHA2 hashes in CertID - #2 by JamesLE and the linked thread there at Support mod_gnutls with Apache - #47 by aarongable and the Github issues linked in that post for more information.

8 Likes