Intent to end OCSP service (letsencrypt.org)

Article summary

Let's Encrypt intends to end its Online Certificate Status Protocol (OCSP) service in favor of Certificate Revocation Lists (CRLs) due to privacy concerns and the simplicity of its infrastructure. The change is expected to occur after the Microsoft Root Program makes OCSP optional, which is anticipated to happen within the next six to twelve months. This change will not affect websites and people visiting them, but may impact non-browser software that relies on OCSP. Let's Encrypt recommends that users start transitioning away from OCSP as soon as possible.

Main themes

• OCSP vs CRLs
• Certificate revocation
• Privacy concerns
• Infrastructure simplicity
• Non-browser software impact

What commenters say

• The decision to end OCSP support may negatively impact non-HTTP services that rely on OCSP stapling, such as mail servers and other TLS-based applications.
• CRLs are not a suitable replacement for OCSP in non-browser applications due to the need for clients to fetch CRLs over HTTP, which can be impractical.
• The move away from OCSP is driven by the WebPKI ecosystem and browser vendors, which may not consider the needs of non-HTTP services.
• Short-lived certificates or mandatory OCSP stapling could be alternative solutions to the problems with OCSP, but implementing these changes across the internet would be slow and difficult.
• Some argue that OCSP must-staple can mitigate man-in-the-middle attacks, but others point out that this is not a foolproof solution and that clients may still fail open.
• The deprecation of OCSP may break existing implementations that rely on it, and users may need to find alternative solutions, such as running their own ACME service.
• The decision to end OCSP support is seen as a step towards simplifying Let's Encrypt's infrastructure and reducing the risk of privacy breaches.