Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.
\nLet’s Encrypt’s December 5, 2024 announcement set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.
\nLet’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.
\nIn a January 22, 2025 post, Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.
\nUse this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.
\nDSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.
\nEach month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.
\nLet’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024). Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025). Reviewed October 18, 2026.
", "content_text": "Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.\nSource facts\nLet’s Encrypt’s December 5, 2024 announcement set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.\nLet’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.\nIn a January 22, 2025 post, Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.\nApplicability\nUse this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.\nDSE recommendation\nDSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.\nVerification\nEach month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.\nOfficial references\nLet’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024). Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025). Reviewed October 18, 2026.", "content_markdown": "Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.\n\n## Source facts\n\nLet’s Encrypt’s [December 5, 2024 announcement](https://letsencrypt.org/2024/12/05/ending-ocsp/) set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.\n\nLet’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.\n\nIn a [January 22, 2025 post](https://letsencrypt.org/2025/01/22/ending-expiration-emails/), Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.\n\n## Applicability\n\nUse this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.\n\n## DSE recommendation\n\nDSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.\n\n## Verification\n\nEach month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.\n\n## Official references\n\n[Let’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024)](https://letsencrypt.org/2024/12/05/ending-ocsp/). [Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025)](https://letsencrypt.org/2025/01/22/ending-expiration-emails/). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/", "url": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients", "item": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/#article", "identifier": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/", "url": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/", "headline": "Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients", "description": "Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its…", "abstract": "Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.", "articleBody": "Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.\nSource facts\nLet’s Encrypt’s December 5, 2024 announcement set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.\nLet’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.\nIn a January 22, 2025 post, Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.\nApplicability\nUse this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.\nDSE recommendation\nDSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.\nVerification\nEach month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.\nOfficial references\nLet’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024). Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:30+00:00", "dateModified": "2026-10-18T22:22:09+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 348, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Let’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024)", "url": "https://letsencrypt.org/2024/12/05/ending-ocsp/" } } ] } }