From 298c357bc9a6023d1ce470ad1711851775313c0a Mon Sep 17 00:00:00 2001
From: Daniel Micay <daniel.micay@grapheneos.org>
Date: Sun, 4 May 2025 21:57:41 -0400
Subject: handle Let's Encrypt removing OCSP support

We can no longer use OCSP stapling and Must-Staple. These will soon be
obsolete once the `shortlived` profile is available for public use since
it will provide certificates with a similar lifetime as OCSP responses.

In the meantime, we've moved to the `tlsserver` profile stripping legacy
features to prepare for the `shortlived` profile which will be identical
to `tlsserver` but with a validity period of 6 days.
---
 static/features.html | 1 -
 1 file changed, 1 deletion(-)

(limited to 'static/features.html')

diff --git a/static/features.html b/static/features.html
index 1dc71e9a..1a650d21 100644
--- a/static/features.html
+++ b/static/features.html
@@ -1489,7 +1489,6 @@
                     when sending mail including alert messages from the attestation service</li>
                     <li>SSHFP across all domains for pinning SSH keys</li>
                     <li>Static key pinning for our services in apps like Auditor</li>
-                    <li>Our web services use robust OCSP stapling with Must-Staple</li>
                     <li>No persistent cookies or similar client-side state for anything other than
                     login sessions, which are set up securely using <code>SameSite=Strict</code>,
                     <code>Secure</code>, <code>HttpOnly</code>, and <code>Path=/</code> flags, prefixed with
-- 
cgit v1.3.1