Let's Encrypt turned off its OCSP service on 6 August 2025 and now publishes revocation information only through Certificate Revocation Lists. If your servers staple OCSP responses from Let's Encrypt certificates, there is nothing left to staple. Check your configuration and your monitoring for stale OCSP assumptions.
What happened
Let's Encrypt announced the change in December 2024 and ended the service on 6 August 2025. It had stopped putting OCSP URLs into new certificates more than 90 days before, so certificates that pointed at the responders have expired by now. Its stated reasons: privacy, since a responder operator can see which sites a visitor's IP address checks and that data could be retained by accident or compelled; and the cost in resources, with the aim of keeping CA infrastructure simple. Quote from the post: "Going forward, we will publish revocation information exclusively via Certificate Revocation Lists (CRLs)."
What this means for you
I could not confirm from the fetched post how OCSP stapling or Must-Staple behave for these certificates, so verify with your CA and server documentation. Based on the dates in the announcement, certificates issued by Let's Encrypt now carry no OCSP URL, which leaves a server with no responder to staple from.
Practical consequences to check:
- Server settings that require OCSP stapling and fail or log errors when none is available.
- Monitoring that alerts on a missing stapled response.
- Documentation or questionnaire answers that say "we use OCSP stapling" for these certificates.
- Certificates from other CAs, which may still run OCSP. The announcement covers Let's Encrypt only.
Revocation in general
RFC 9325 says implementations need a strategy to distrust revoked certificates, and that servers should support OCSP and stapling. It also notes Must-Staple is optional and operators should consider operating conditions first. That guidance predates this change in practice for one large CA, so treat it as a general principle rather than a setting to force.
Short lived certificates reduce reliance on revocation, because a compromised key stops working at expiry anyway. Let's Encrypt offers an opt in six day certificate profile per its FAQ, and it is moving default lifetimes down. See certificate lifetimes shrinking to 47 days.
What to do after a key compromise
- Generate a new key. Do not reuse the old one.
- Get a new certificate and deploy it everywhere the old one was used.
- Ask your CA to revoke the old certificate.
- Search for the old certificate elsewhere: appliances, backups, partner systems.
- Review how the key leaked.
Quick check
Does the end of OCSP mean revocation no longer works?
No. Revocation information is published through CRLs. How each client consumes those lists varies, so do not assume a revoked certificate is rejected everywhere at once.
Should I remove OCSP stapling from my server config?
Check per certificate. Remove hard failures tied to OCSP for Let's Encrypt certificates, and leave stapling in place for CAs that still run responders.
Sources
Last reviewed: 19 October 2026.
