# Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients

> Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.

- Canonical URL: https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:01:30+00:00
- Modified: 2026-10-18T22:22:09+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Briefing
- DSE priority: Advisory
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.

## Potentially affected

Organizations using Let’s Encrypt certificates on websites, VPNs, mail servers, video recorders, door controllers or other devices, and administrators who relied on its expiry emails.

## DSE recommendation

DSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs.

## Article

Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.

## Source facts

Let’s Encrypt’s [December 5, 2024 announcement](https://letsencrypt.org/2024/12/05/ending-ocsp/) set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.

Let’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.

In a [January 22, 2025 post](https://letsencrypt.org/2025/01/22/ending-expiration-emails/), Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.

## Applicability

Use this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.

## DSE recommendation

DSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.

## Verification

Each month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.

## Official references

[Let’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024)](https://letsencrypt.org/2024/12/05/ending-ocsp/). [Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025)](https://letsencrypt.org/2025/01/22/ending-expiration-emails/). Reviewed October 18, 2026.

## Primary reference

- Name: Let’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024)
- Authority: letsencrypt.org
- URL: https://letsencrypt.org/2024/12/05/ending-ocsp/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients,” DSE Security, https://update.dsesecurity.com/updates/lets-encrypt-ended-ocsp-expiration-emails-2025-certificate-monitoring/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.