Windows Live Mail revocation warning

[Osiris]

@fas

Is there really nothing that can be done to deal with the underlying problem?

I don't think Let's Encrypt is going to generate a CRL, just to make sure a single discontinued mail client works? They've made a choice to issue only signed OCSP statuses and don't use CRL's. So I'm guessing that was a deliberate choice, not something they decided lightly.

@fas

I don't know much about CRL, but is there maybe some way to make a bridge back from OCSP data to CRL, enough to make the obsolete Live mail program work even if revocation isn't possible there (…)

The mail client expects these CRL data inside the certificate, which is signed by Let's Encrypt. Furthermore, it would be insane to generate a CRL without using it for revocation checking! That's the whole point to a CRL! You can't expect Let's Encrypt to maintain a seperate bunch of certificates with a "fake" CRL. That's probably against the CA/B Forum rules too..

@fas

(…) or some way we might be able to patch Live Mail. Might an approach to Microsoft be helpful?

I guess that's something you should ask MS indeed, but don't get your hopes up..