I guess you still have a peak time of 00:00 UTC every day though unless people are using servers set to their local time.
I guess you still have a peak time of 00:00 UTC every day though unless people are using servers set to their local time.
Examples of reasons your certificate might have been revoked:
* You re-used a private key from somewhere, perhaps because you don't understand what "private" means, and other copies of that key leaked
* You didn't re-use the private key but your "clever" backup strategy involves putting the private key file in a public directory named /backup/server/ on your web server and somebody found it
* You use the same certificate for dozens of domain names in your SEO business and yesterday you sold a name for $10k. Hooray. The new owner immediately revoked all certificates for that name which they're entitled to do.
* Your tooling is busted and the "random" numbers it picked aren't very random. (e.g. Debian OpenSSL bug)
* A bug at Let's Encrypt means their Ten Blessed Methods implementation was inadequate for some subset of issuances and rather than cross their fingers the team decided to revoke all certificates issued with the inadequate control.
* Let's Encrypt discovers you're actually a country sanctioned by the US State Department, perhaps in some thin disguise such as an "independent" TV station in a country that doesn't have any independent media whatsoever. It is illegal for them to provide you with services and you were supposed to already know that.
So that is a network connection, but not to the Let's Encrypt servers described in this story.
In practice OCSP is done by a big CA by periodically computing OCSP responses for every single unexpired certificate (either saying it's still valid, or not), and then providing those to a CDN and the CDN acts as "OCSP server" returning the appropriate OCSP response when asked without itself having possession of any cryptographic materials.