SC-076v2: OCSP answers within 15 minutes of issuance

SC-076v2 cleaned up the OCSP rules and set one concrete deadline: since 2025-01-15, if a TLS certificate contains an OCSP URL, the CA's responder must give an authoritative "good" or "revoked" answer for it within 15 minutes of the certificate first being published.

What changed

SC-076v2 moved all OCSP requirements into §4.9.9 and fixed three sources of confusion that the ballot text lists. First, "reserved" serial numbers: since every precertificate serial is assumed to belong to a real certificate, the concept was removed and such serials count as assigned. Second, how quickly responders must start answering for new certificates and precertificates: now 15 minutes. Third, whether the rules apply to certificates without an OCSP URL that a responder still answers for. Section 4.9.9 groups the requirements into definitions, requirements on responders (only for responders named in issued certificates) and requirements on responses (for every response).

Effective dates

The BR change took effect on 2024-11-14; the 15-minute rule applies from 2025-01-15.

Who is affected

SC-076v2 affects CAs that still run OCSP; SC-063v4 made OCSP optional, and Let's Encrypt, for one, has since shut its OCSP service down. For site operators the rule matters with OCSP stapling: right after a new certificate is installed, a web server could previously fetch an "unknown" response and staple it.

What to do

No new action is needed. If you staple OCSP and deploy certificates seconds after issuance, a short delay or a server that retries stapling avoids serving a useless response. Read OCSP and CRL for the bigger picture.