ryao 3 days ago

Could you explain why Let's Encrypt is dropping OCSP stabling support, instead of dropping it for must-staple only certificates and letting those of us who want must-staple to deal with the headaches? I believe that resolving the privacy concerns involving OCSP raised did not require eliminating must-staple.

1
mcpherrinm 8 hours ago

Must-staple has almost zero adoption. The engineering cost of supporting it for a feature that is nearly unused just isn’t there.

We did consider it.

As CAs prepare for post-quantum in the next few years, it will become even less practical as there is going to be pressure to cut down the number of signatures in a handshake.