SC-063v4: OCSP becomes optional, CRLs become mandatory

SC-063v4 turned the revocation rules around: since 2024-03-15, publicly trusted TLS CAs no longer have to run an OCSP responder, but they must publish CRLs. The same ballot created a "short-lived certificate" category, valid for 10 days at most (7 days from 2026-03-15), that needs no revocation pointer at all.

What changed

SC-063v4 made OCSP optional, made CRLs mandatory and exempted short-lived certificates from revocation. CAs that keep OCSP must still follow the existing OCSP rules. CRLs got a profile: a CA must publish either one full CRL or a set of partitioned ("sharded") CRLs that together cover everything. A new CRL is due within 24 hours after a revocation, and otherwise at least every 7 days if all certificates contain an OCSP URL, or every 4 days in all other cases. Short-lived certificates may leave out CRL and OCSP pointers and don't need to be revoked, because expiry does the job.

The ballot was proposed by Google's Chrome Root Program and endorsed by Microsoft and Sectigo.

Effective dates

The BR text became effective on 2024-03-15. The 7-day cap for short-lived certificates applies to those issued from 2026-03-15.

Who is affected

CAs bear most of the work. For site operators the visible effect came later, when CAs chose to switch OCSP off: Let's Encrypt, for example, announced the end of its OCSP service. OCSP stapling only works where the CA still runs OCSP, and certificates with the OCSP Must-Staple extension depend on it entirely.

What to do

If you staple OCSP, keep the configuration but expect it to become a no-op for certificates without an OCSP URL; nginx and Apache skip stapling then. Don't request Must-Staple certificates any more. Clients that check revocation should support CRLs. See OCSP and CRL explained.