10 ms·

Sounds like letsencrypt is being quite premature by turning off OCSP. https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life https://letsencry

by oofbey 1y ago

Sounds like letsencrypt is being quite premature by turning off OCSP. https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-... Might be EOL in some theoretical sense, but by turning it off they're ignoring reality. I know some organizations think this is the way to push standards forward. But to me it seems pretty irresponsible.

jsiepkes 1y ago
As far as I know OCSP isn't enabled by default in any browser.
- chrismorgan 1y ago
  It’s enabled in Firefox (pref security.OCSP.enabled defaults to 1¹), but not forced (pref security.OCSP.require defaults to false²). I believe Safari behaves the same way. —though I’m not sure how this fits in with https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co... which said “we will be disabling OCSP for domain validated certificates in Firefox 142”. This is a stunningly fuzzy area where the true and accurate information is difficult to come by. —⁂— ¹ https://searchfox.org/firefox-main/source/modules/libpref/init/StaticPrefList.yaml#16999-17009 https://searchfox.org/firefox-main/source/modules/libpref/in.... Actually, on Android it defaults to 2, which skips OCSP on DV certificates, which is almost all these days. ² https://searchfox.org/firefox-main/source/modules/libpref/init/StaticPrefList.yaml#17013-17019 https://searchfox.org/firefox-main/source/modules/libpref/in...
  - jsiepkes 1y ago
    > “we will be disabling OCSP for domain validated certificates in Firefox 142”. This is a stunningly fuzzy area where the true and accurate information is difficult to come by. Doesn't seem all that fuzzy to me? Domain validated certificates are certificates where only domain name ownership is verified (like ACME does for Let's Encrypt). So it seems starting with Firefox 142 OCSP would be disabled by default for Let's Encrypt certificates.
    - chrismorgan 1y ago
      The pref defaults don’t match that narrative. The blog post could be wrong, the prefs could have been repurposed without being renamed, something else… and the whole thing is very difficult to inspect.
usr1106 1y ago
Do all other major CAs offer OCSP? Are all major browsers performing the check? I vaguely remember Firefox doesn't. Not at my desk now to check it... Edit: I believe OCSP is tried, but silently ignored if there is no reponse quickly enough.
- unit149 1y ago
  [dead]
- Ayesh 1y ago
  Firefox has a a toggle `Query OCSP responder servers to confirm the current validity of certificates`, which is turned off by default. Edit: It seems to be enabled by default! I've been using Firefox for as long as I remember, and don't setup Firefox afresh frequently.
  - deleted 1y ago
    [deleted]
deleted 1y ago
[deleted]
mholt 1y ago
> Sounds like letsencrypt is being quite premature by turning off OCSP. Not really, since they now offer six-day certs, which makes revocation effectively irrelevant: https://letsencrypt.org/docs/profiles/#shortlived https://letsencrypt.org/docs/profiles/#shortlived

by oofbey 1y ago

jsiepkes 1y ago

As far as I know OCSP isn't enabled by default in any browser.

chrismorgan 1y ago
It’s enabled in Firefox (pref security.OCSP.enabled defaults to 1¹), but not forced (pref security.OCSP.require defaults to false²). I believe Safari behaves the same way. —though I’m not sure how this fits in with https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co... which said “we will be disabling OCSP for domain validated certificates in Firefox 142”. This is a stunningly fuzzy area where the true and accurate information is difficult to come by. —⁂— ¹ https://searchfox.org/firefox-main/source/modules/libpref/init/StaticPrefList.yaml#16999-17009 https://searchfox.org/firefox-main/source/modules/libpref/in.... Actually, on Android it defaults to 2, which skips OCSP on DV certificates, which is almost all these days. ² https://searchfox.org/firefox-main/source/modules/libpref/init/StaticPrefList.yaml#17013-17019 https://searchfox.org/firefox-main/source/modules/libpref/in...
- jsiepkes 1y ago
  > “we will be disabling OCSP for domain validated certificates in Firefox 142”. This is a stunningly fuzzy area where the true and accurate information is difficult to come by. Doesn't seem all that fuzzy to me? Domain validated certificates are certificates where only domain name ownership is verified (like ACME does for Let's Encrypt). So it seems starting with Firefox 142 OCSP would be disabled by default for Let's Encrypt certificates.
  - chrismorgan 1y ago
    The pref defaults don’t match that narrative. The blog post could be wrong, the prefs could have been repurposed without being renamed, something else… and the whole thing is very difficult to inspect.

usr1106 1y ago

Do all other major CAs offer OCSP? Are all major browsers performing the check? I vaguely remember Firefox doesn't. Not at my desk now to check it... Edit: I believe OCSP is tried, but silently ignored if there is no reponse quickly enough.

unit149 1y ago
[dead]
Ayesh 1y ago
Firefox has a a toggle `Query OCSP responder servers to confirm the current validity of certificates`, which is turned off by default. Edit: It seems to be enabled by default! I've been using Firefox for as long as I remember, and don't setup Firefox afresh frequently.
- deleted 1y ago
  [deleted]

deleted 1y ago

[deleted]

mholt 1y ago

> Sounds like letsencrypt is being quite premature by turning off OCSP. Not really, since they now offer six-day certs, which makes revocation effectively irrelevant: https://letsencrypt.org/docs/profiles/#shortlived https://letsencrypt.org/docs/profiles/#shortlived