diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2025-05-04 21:57:41 -0400 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2025-05-04 23:46:56 -0400 |
| commit | 298c357bc9a6023d1ce470ad1711851775313c0a (patch) | |
| tree | 1cd61c8c4e8a5c692b11e645c8ed28a4f2501f36 /static/features.html | |
| parent | c57490de09fcdc3eadadc8422b4b17da313841b2 (diff) | |
handle Let's Encrypt removing OCSP support
We can no longer use OCSP stapling and Must-Staple. These will soon be
obsolete once the `shortlived` profile is available for public use since
it will provide certificates with a similar lifetime as OCSP responses.
In the meantime, we've moved to the `tlsserver` profile stripping legacy
features to prepare for the `shortlived` profile which will be identical
to `tlsserver` but with a validity period of 6 days.
Diffstat (limited to 'static/features.html')
| -rw-r--r-- | static/features.html | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/static/features.html b/static/features.html index 1dc71e9a..1a650d21 100644 --- a/static/features.html +++ b/static/features.html @@ -1489,7 +1489,6 @@ when sending mail including alert messages from the attestation service</li> <li>SSHFP across all domains for pinning SSH keys</li> <li>Static key pinning for our services in apps like Auditor</li> - <li>Our web services use robust OCSP stapling with Must-Staple</li> <li>No persistent cookies or similar client-side state for anything other than login sessions, which are set up securely using <code>SameSite=Strict</code>, <code>Secure</code>, <code>HttpOnly</code>, and <code>Path=/</code> flags, prefixed with |