The nonprofit certificate authority Let\u2019s Encrypt, community-controlled and providing certificates free of charge to anyone who wants them, has decided to discontinue support for the OCSP (Online Certificate Status Protocol) used for certificate revocation checking. Instead of the OCSP protocol, it is recommended to use Certificate Revocation Lists (CRL), published by Let\u2019s Encrypt starting in 2022. On May 7, 2025, Let\u2019s Encrypt will disable the inclusion of OCSP address links in issued certificates and will cease processing requests related to the use of the \u2018OCSP Must Staple\u2019 extension. On August 6, 2025, OCSP request handlers will be disabled on the servers. <\/p>\n
Privacy concerns are cited as the reason for discontinuing OCSP support. The use of OCSP results in the client system sending a request to the OCSP server of the certificate authority that issued the certificate with each establishment of a secure connection to check the certificate's validity. In response, the server provides information on whether the specified certificate is trustworthy. The problem is that the certificate authority receives information about when and which websites the user visits, tied to their IP address<\/a>, which could be seen as a leak of confidential data. Additionally, using OCSP introduces a delay in processing requests, requires the user to have guaranteed network access, and creates a dependency on the uninterrupted operation of OCSP servers. <\/p>\n To address privacy issues when checking certificate revocation, the OCSP Stapling technology was developed, which allows OCSP responses certified by the certificate authority to be transmitted by the servers hosting the sites during the TLS connection negotiation with the client (the transfer of OCSP information is shifted to servers<\/a> the sites, which frees the client system from making direct requests to the OCSP server of the certificate authority, while the correctness of the responses is ensured by the digital signature of the certificate authority). <\/p>\n In addition to OCSP Stapling, there is an extension added to certificates called \u2018OCSP Must Staple\u2019, which mandates browsers to use the OCSP Stapling technique instead of directly contacting OCSP servers and requires the certificate to be considered untrustworthy if the server hosting the site does not return a signed OCSP response. Unfortunately, the \u2018Must Staple\u2019 extension has not gained widespread adoption in browsers, and the OCSP Stapling technology relies on explicit support being enabled on the HTTP server side (supported in nginx since 2013). <\/p>\n When using CRL, certificate revocation checks are performed on the local system based on lists generated by the certificate authority. The downsides of this approach include the very large size of the data downloaded and a temporary gap in the timeliness of information (for example, in Firefox, the data is updated every 6 hours). The size issue is addressed in browsers through CRL proxying on the browser manufacturers' servers \u2014 a basic CRL is included in the browsers, which periodically syncs with the current list during operation (only changed data is transmitted to the client\u2019s system). To reduce the database size with CRL, a probabilistic structure known as a \u2018Bloom filter\u2019 is used, allowing for the entire CRL database to be stored on the client side in a very compact representation. In Firefox, this technique is implemented using the CRLite toolkit, while in Chrome, it is done through CRLSets. \u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt discontinues support for the OCSP protocol for checking revoked certificates | ProHoster","description":"The non-profit Let's Encrypt certificate authority, community-controlled and providing certificates free of charge to anyone who wants them, has decided to discontinue support for the OCSP (Online Certificate Status) protocol.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let's Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"