In light of the recent (disappointing) announcement regarding ending OCSP support , what will happen to Must-Staple support? What should clients do to account for this change? The announcement makes no mention of Must-Staple. Thinking of things like Certbot's --must-staple flag that people have hard…

A multi-part answer: This is a very early announcement of intent. We don't have all the details, such as how to deal with Must-Staple, worked out yet. There will be follow-up announcements as timelines and implementation details become firmer. One possibility would be a transitional period in whic…

Thanks for the reply Aaron. I'll be interested to follow the developments. I'm sure removing support for Must-Staple will be inconvenient for the operators who use it as it will certainly cause their automated systems to fail issuing certs. [image] aarongable: Finally, the privacy risk of OCSP …

[image] Nummer378: Big browsers may have that, but for me TLS + PKI is more than just Chrome + Firefox - I'm thinking devices like IoT, server-to-server communication and friends that do not benefit of stuff like CRLite. For those you're correct - they rarely look at CRLs. Any ideas what perc…

[image] mholt: Plaintext is not really an issue as the content is signed, so when privacy-preserving servers that actually implement stapling act as the clients, OCSP is a private, secure way to deliver certificate status, as it doesn't reveal anything surprising to observers. It's not like rely…

[image] aarongable: end-users are making the requests So... ask them to stop? It's mainly Firefox these days, right? Surely this is something Mozilla could discuss. Why cut off the privacy benefits of OCSP stapling from the many thousands(++) of servers that are legitimately stapling certs, …

[image] aarongable: browsers are revealing what sites are visited I would love to see any high-level aggregate stats you (or other CAs) could provide for what user agents are requesting OCSP.

*smacks forehead* Of course! I feel silly for asking the question. Thank you for trying so hard!

From our privacy policy: If your browser makes an OCSP request, our servers will automatically record your IP address, browser, and operating system in temporary server log files. We do not use data from OCSP requests to build profiles or identify individuals. Temporary server logs are used for op…

[image] mholt: Ending OCSP leaves critical gaps in PKI reliability. Not really. I trust that the recent moves towards p256 as a default will free up enough capacity to move from 90 days to 30. And CRLs should work fine if we assume some sharding (even though I'm afraid they'll still be quite …

anyway this means LE must include crlDistributionPoints as BR 7.1.2.11.2: and I kinda sure there are many thing will download CRLs without thinking about it: (like about everything that isn't browsers, and not sure if they cache crl at all)

What will happen to Must-Staple

Issuance Policy

aarongable July 23, 2024, 10:25pm 13

We very purposefully try our hardest to never have that information.

Sunsetting of OCSP in favor of older technology?

Topic		Replies	Views
Sunsetting of OCSP in favor of older technology? Issuance Policy	24	3064	August 31, 2024
Modest Proposal for Preserving OCSP Issuance Policy	14	516	September 18, 2024
Improving revocation : will Let's Encrypt support OCSP Must-staple? Feature Requests	68	23582	June 25, 2016
Requesting feedback on a draft email for subscribers currently using OCSP must-staple Site Feedback	26	804	March 20, 2025
Plea to extend Let's Encrypt support to OCSP Help	53	1166	June 9, 2025

What will happen to Must-Staple

Related topics