2 ms·
There was an idea we discussed of "intent to revoke", but it ended up looking like a quite a bit of work for a small benefit, so the situation is as mholt descr
by schoen 5y ago
There was an idea we discussed of "intent to revoke", but it ended up looking like a quite a bit of work for a small benefit, so the situation is as mholt describes. :-)
For this specific reason, Certbot is recommended to run twice per day, and that is the default behavior in OS Certbot packages as well as the more recent official snap package.
Further to mholt's point, not all clients will enforce OCSP at all, while if you're using stapling, the client is being told about the last-valid OCSP response, so the outage would probably be a fairly small minority of clients in either case.
- kiwijamo 5y agoI know of at least one OS Certbot package where the check is only done weekly--FreeBSD. Would be interested to know if the twice-daily approach is the default in other OS packages.
- schoen 5y agoWow, thanks for pointing this out. Do you know who maintains this for FreeBSD, by any chance?