Let's Encrypt, the free certificate authority behind a large share of the web's TLS certificates, ended its support for the Online Certificate Status Protocol (OCSP) in 2025. New certificates stopped carrying an OCSP address in May 2025, and the OCSP responders were switched off in August 2025. Revocation information is now published through certificate revocation lists (CRLs).
Why the change
OCSP lets a browser ask the certificate authority whether a certificate has been revoked. In practice it had problems. Each check told the certificate authority which site a user was visiting, which is a privacy issue. It added a network request to connections. And browsers often ignored failed checks, so it did not protect much. Modern browsers already use their own compressed revocation lists, built from CRLs.
Does it affect you?
For most websites, nothing changes. Browsers keep validating certificates as before.
You may need to act if:
- Your web server is configured to require OCSP stapling and fails when no OCSP address exists. Remove the "must staple" requirement or update the configuration.
- You have certificates that include the OCSP Must-Staple extension. Let's Encrypt stopped issuing them; request new certificates without it.
- Internal tools or monitoring check revocation only through OCSP. Update them to use CRLs.
The bigger picture
This change and the move to 47-day certificates point the same way: rather than relying on revocation, the industry is making certificates short-lived enough that a compromised one expires quickly. Automated renewal becomes essential.
How IDX helps
Certificates on IDX hosting are issued and renewed automatically, and our web servers are kept on current, supported configurations. If you run your own servers with us and are unsure whether this change affects your setup, our team can check it.
IDX on digital infrastructure
Back to blog →