A missing OCSP response does not fail closed, nor does a CLR url 404-ing fail closed. The information leakage of CRLs is stating to the public that a cert need

A missing OCSP response does not fail closed, nor does a CLR url 404-ing fail closed. The information leakage of CRLs is stating to the public that a cert needed to be revoked. Obviously, a compromised cert that will expire in 5 years is horrible. However, a non compromised cert you are no longer using that will never expire is more off a risk than a disused cert that will expire in a year. Not to say you should leave the one year cert lying around. However, there is no desire to put the one year cert on a pre-shipped CLR.