Removed: the OCSP responder that answered certificate revocation checks — more than four billion requests a day at the start of 2025 — and the millions of subscriber email addresses kept alongside issuance records.
Outcome: “There was no major fallout and we haven’t looked back,” Josh Aas wrote in ISRG’s year-end letter. Over the same year the CA went from serving 492 million websites to 762 million.
OCSP made the browser ask the CA about every site it visited, which is a record of browsing handed to a third party. Let’s Encrypt says it never retained that data — “it got dropped immediately” — but it could not vouch for anyone else: “there is no way to know if that was standard practice across the industry, and even well-intentioned CAs could make a mistake or be compelled to save that data. It was a system ripe for abuse.” It turned the responder off in August 2025.
The cost, stated plainly: the change “limits our ability to contact subscribers and we had to turn off our expiration reminder email service”.
Sources:
- Let’s Encrypt, A Note from our Executive Director (29 December 2025)
- ISRG, 2025 Annual Report (where the letter was first published)