Let’s Encrypt ended OCSP and expiry emails in 2025: monitor certificate renewals yourself and check non-browser clients

Let’s Encrypt stopped sending expiration notification emails on June 4, 2025, dropped OCSP URLs from certificates on May 7, 2025 and turned off its OCSP responders on August 6, 2025, providing revocation information through CRLs instead. It warned that some non-browser software, such as VPNs, might be affected.

Source facts

Let’s Encrypt’s December 5, 2024 announcement set a timeline to provide revocation information only through Certificate Revocation Lists: OCSP Must-Staple issuance requests began failing on January 30, 2025, OCSP URLs were dropped from certificates on May 7, 2025 after CRL URLs were added, and its OCSP responders were turned off on August 6, 2025. It said websites and visitors would not be affected but some non-browser software might be, and that VPN operators should ensure their software works when certificates contain no OCSP URL.

Let’s Encrypt said it ended OCSP mainly because OCSP lets the certificate authority learn which website is being visited from a visitor’s IP address, a privacy risk CRLs do not have. It recommended that anyone relying on OCSP start ending that reliance as soon as possible.

In a January 22, 2025 post, Let’s Encrypt said it would end expiration notification emails on June 4, 2025, citing reliable renewal automation, privacy, cost and complexity, and recommended a third-party monitoring service for anyone who still wants expiry notices.

Applicability

Use this for any system with Let’s Encrypt certificates, including devices with built-in ACME clients. Other certificate authorities have their own revocation and notification practices; check each one in use.

DSE recommendation

DSE recommends setting up independent expiry monitoring for every Let’s Encrypt certificate and confirming non-browser clients accept certificates without OCSP URLs. Inventory where each certificate is installed, alert well before expiry and on renewal failures, remove any ACME client setting that requests Must-Staple, and send alerts to a shared mailbox rather than one person.

Verification

Each month, compare the monitoring list against the ACME client inventory and Certificate Transparency records, and confirm alerts fire by testing with a short-lived certificate in a lab.

Official references

Let’s Encrypt — Ending OCSP Support in 2025 (December 5, 2024). Let’s Encrypt — Ending Support for Expiration Notification Emails (January 22, 2025). Reviewed October 18, 2026.