Let’s Encrypt Phases Out Certificates Expiry Notifications
Quoting: Let’s Encrypt Phases Out Certificates Expiry Notifications —
In a move that has surprised many, Let’s Encrypt, the world’s leading provider of free, automated, and open SSL/TLS certificates for websites, has announced plans to end its longstanding practice of sending email reminders about certificate expirations.
Update
-
Integrity/Availability/Authenticity - more updates
-
Feisty Duck ☛ The Slow Death of OCSP
Everybody is talking about OCSP now because, just last month, at the end of 2024, Let’s Encrypt announced it was going to stop supporting online certificate revocation checking. Beginning in early May 2025, there will no longer be any OCSP revocation information in Let’s Encrypt’s certificates. Once all its earlier certificates expire, Let’s Encrypt will shut down its OCSP servers.
Let’s Encrypt’s reasoning is sound. As it stands today, OCSP is not making anyone more secure. Browsers are either not checking it or are implementing it in a way that provides no security benefits. As a result, OCSP is just costing Let’s Encrypt good money in personnel and infrastructure costs. How much money? Let’s Encrypt hasn’t disclosed the actual costs, but its executive director did share with Scott Helme that Let’s Encrypt was servicing about twelve billion OCSP requests daily (about 140,000 every second).
-
Ending Support for Expiration Notification Emails - Let's Encrypt
Since its inception, Let’s Encrypt has been sending expiration notification emails to subscribers that have provided an email address to us. We will be ending this service on June 4, 2025. The decision to end this service is the result of the following factors: [...]
-