What will happened if the client can't access CRL?

[iseki0]

I think the requests will get failed if the client can't access to the CRL endpoint.
Please continue provide the OCSP stapling.
In China or some limited network(Such as companies or schools) if the government block the CRL domain the certificate will not be useable for some non browser clients. It's harmful to the internet.

[MikeMcQ]

@iseki0

I think the requests will get failed if the client can't access to the CRL endpoint.

That depends on the client. With OCSP many clients (like many browsers) would ignore problems accessing OCSP and allow connection anyway.

@iseki0

Please continue provide the OCSP stapling.

Let's Encrypt stopped putting OCSP URLs in its certificates this past May6. The OCSP servers themselves were shutoff in Aug. See this notice from Dec 2024: Ending OCSP Support in 2025 - Let's Encrypt

And this blog from Aug6 this year: OCSP Service Has Reached End of Life - Let's Encrypt

@iseki0

if the government block the CRL domain the certificate will not be useable for some non browser clients

Governments could also have blocked the OCSP domains. This is no different. Are there particular TLS clients you are concerned about?

@iseki0

It's harmful to the internet.

Let's Encrypt believes the lack of privacy with OCSP to be worth it. Not to mention OCSP did not provide the reliable way to detect cert revocation that people expected. There was considerable discussion of this when first announced last year.

Please read the Aug6 blog post.