What is the relationship between the revoking list and OCSP Stapling?

[coeurl]

@jvanasco

That is only happening with the Firefox browser. It is not happening with Chrome, Safari or Edge. Nothing right now suggests that is due to OCSP stapling. Are you in control of that domain and able to turn stapling on and off for tests?

Oops, I didn't go through this comment.

Unfortunately, the domain in question is not under my control, so I can't control OCSP Stapling.

@jvanasco

That is simply how OCSP stapling works. The entirety of the stapled OCSP response - including the "Cert Status: good " - was generated at the "This Update" timestamp, and then digitally signed. The "Next Update" just means the CA will have an update by that timestamp at a minimum (see RFC 6960 - X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP). That date does not expire the staple, like a "notAfter" date would. According to the CA/B forum rules (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.1.pdf) Servers and Browsers are allowed to cache the "good" status for up to 10 days.

Yes, I understand very well. Thanks.