OCSP is stapled automatically by Caddy, for example. It gets refreshed halfway through the response's validity period, so it will know well ahead of time if a c

OCSP is stapled automatically by Caddy, for example. It gets refreshed halfway through the response's validity period, so it will know well ahead of time if a certificate is revoked, allowing it to replace the certificate for you automatically. No downtime, no unusable certificate, etc, because even while it serves the revoked certificate, the OCSP response that is stapled to it shows valid for some remaining amount of time. Of course, clients can do whatever they want to enforce OCSP, including pushing their own revocation lists and ignoring OCSP staples. Sigh.