Let’s Encrypt ended its OCSP service on August 6, 2025. Inspect the certificate your TLS endpoint actually serves and its metadata. Missing OCSP stapling alone does not mean the certificate is revoked or HTTPS is broken. Remove stale stapling configuration only after inventorying all certificates on the server.
OCSP let a client ask about certificate status; stapling let a server attach a signed response to the TLS handshake. Let’s Encrypt announced the service shutdown on August 6, 2025, following its earlier plan. The operational impact depends on the certificate and client. An old instruction to enable ssl_stapling everywhere should not be copied blindly to every new certificate.
Ask three separate questions
| Question | Check | Interpretation |
|---|---|---|
| Which certificate does the client see? | openssl s_client -servername | A CDN may serve a different certificate from the origin |
| Does the certificate contain an OCSP URL? | openssl x509 -text, AIA field | No URL means an OCSP lookup is not applicable to it |
| Was a response stapled? | openssl s_client -status | “No response sent” is not a revocation verdict |
Check the public hostname and origin separately when a CDN terminates TLS. Pass SNI on multi-certificate endpoints. The s_client guide explains both SNI selection and name validation.
Inspect the certificate and stapling separately
openssl s_client -connect example.com:443 -servername example.com -status </dev/null 2>&1 | sed -n '/OCSP response:/,/Certificate chain/p'
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -text | sed -n '/Authority Information Access/,+8p'
# Also inspect issuer, validity and SAN in the full certificate output.The first command shows whether this handshake included a stapled response. The second inspects the leaf certificate’s AIA extension. The pipeline assumes the first certificate emitted by s_client is the leaf; verify ordering on an unusual endpoint. Inspect name, validity and chain separately through an SSL check. Expiration and revocation are distinct states.
nginx documents ssl_stapling on; in its SSL module. If no served certificate has an OCSP responder URL, stale configuration may produce a warning. Inventory every virtual host before removing it: another CA’s certificate may still use OCSP. Then run nginx -t, reload and check the public certificate again. Client certificate verification is a separate feature and should not be changed as part of this cleanup.
What users might observe
A browser does not necessarily need a stapled response from every certificate for HTTPS to succeed. A corporate client or custom revocation policy may treat its absence differently, so test that client explicitly. Do not assert that all post-shutdown connections must fail or that all are safe: the result depends on the actual client, certificate and chain. If the failure is curl (60), use the curl error guide before attributing it to OCSP.
A live public-endpoint check
On November 13, 2026, the public enterno.io TLS endpoint served a certificate with CN=enterno.io from Let’s Encrypt YR2. OpenSSL reported no stapled OCSP response while still verifying the trust chain:
OCSP response: no response sent
subject=CN=enterno.io
issuer=C=US, O=Let's Encrypt, CN=YR2
Protocol: TLSv1.3
Verify return code: 0 (ok)This is one public-endpoint snapshot, not a test of every client or the origin. It shows why no response sent alone is not a trust failure. The command and selected output are saved in the draft’s data.json.
How we made this guide
The shutdown date comes from Let’s Encrypt; command syntax comes from OpenSSL and nginx. We do not have a preserved before-and-after sample from August 2025, so this article makes no claim about the number of affected sites. SerpAPI and Wordstat only informed query wording. Wordstat region 225 returned no estimate for the exact query and 1 for the broader ocsp lets encrypt.
FAQ
Does “no response sent” mean revoked?
No. It only describes this TLS handshake.
Should stapling be disabled on every server?
Inventory all certificates first. Other CAs may still provide OCSP.
Must I reissue the certificate now?
The OCSP shutdown by itself does not require reissuance. Check validity, name, chain and client requirements.
Why do CDN and origin disagree?
They can terminate TLS independently and serve different certificates. Test each endpoint separately.
