Skip to content

Commit

Permalink
Remove suggestion for OCSP Stapling from the Integration Guide (#1788)
Browse files Browse the repository at this point in the history
# Important

- If this PR updates a file in `content/en` with a `lastmod` field, it
**must** be updated.

- If this PR is a translation, please read
https://github.com/letsencrypt/website/blob/master/TRANSLATION.md first.
  • Loading branch information
jcjones authored Dec 9, 2024
1 parent 5f4cad9 commit 929019c
Showing 1 changed file with 1 addition and 7 deletions.
8 changes: 1 addition & 7 deletions content/en/docs/integration-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Integration Guide
linkTitle: Client and Large Provider Integration Guide
slug: integration-guide
date: 2016-08-08
lastmod: 2020-12-08
lastmod: 2024-12-09
show_lastmod: 1
---

Expand Down Expand Up @@ -88,12 +88,6 @@ If you want to use the http-01 challenge anyhow, you may want to take advantage

Related to the above two points, it may make sense, if you have a lot of frontends, to use a smaller subset of servers to manage issuance. This makes it easier to use redirects for http-01 validation, and provides a place to store certificates and keys durably.

# Implement OCSP Stapling

Many browsers will fetch OCSP from Let's Encrypt when they load your site. This is a [performance and privacy problem](https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/). Ideally, connections to your site should not wait for a secondary connection to Let's Encrypt. Also, OCSP requests tell Let's Encrypt which sites people are visiting. We have a good privacy policy and do not record individually identifying details from OCSP requests, we'd rather not even receive the data in the first place. Additionally, we anticipate our bandwidth costs for serving OCSP every time a browser visits a Let's Encrypt site for the first time will be a big part of our infrastructure expense.

By turning on OCSP Stapling, you can improve the performance of your website, provide better privacy protections for your users, and help Let's Encrypt efficiently serve as many people as possible.

# Firewall Configuration

To use Let's Encrypt, you need to allow outbound port 443 traffic from the
Expand Down

0 comments on commit 929019c

Please sign in to comment.