Let's Encrypt 颁发的证书所包含的 CRL 链接完全被墙，可能导致所有用 LE 证书的网站在国内无法打开或者弹出警告。

[villivateur]

今天用 curl 访问我的网站，发现报错：

$ curl -vv https://www.example.com/generate_204
08:43:01.876922 [0-0] * Host www.vvzero.com:443 was resolved.
08:43:01.880422 [0-0] * IPv6: 2408:1:1013:e900::1
08:43:01.883004 [0-0] * IPv4: 1.116.4.74
08:43:01.885021 [0-0] * [HTTPS-CONNECT] added
08:43:01.887128 [0-0] * [HTTPS-CONNECT] connect, init
08:43:01.889315 [0-0] * [HTTPS-CONNECT] connect, check h21
08:43:01.891506 [0-0] *   Trying [2408:1:1013:e900::1]:443...
08:43:01.894156 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
08:43:01.896145 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
08:43:01.898445 [0-0] * [HTTPS-CONNECT] connect, check h21
08:43:01.901163 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
08:43:01.903526 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
08:43:01.907055 [0-0] * [HTTPS-CONNECT] connect, check h21
08:43:01.910135 [0-0] * schannel: disabled automatic use of client certificate
08:43:01.917094 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
08:43:01.919009 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
08:43:01.924728 [0-0] * [HTTPS-CONNECT] connect, check h21
08:43:01.933717 [0-0] * schannel: next InitializeSecurityContext failed: CRYPT_E_REVOCATION_OFFLINE (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline.
08:43:01.939440 [0-0] * [HTTPS-CONNECT] connect, all failed
08:43:01.941833 [0-0] * [HTTPS-CONNECT] connect -> 35, done=0
08:43:01.944171 [0-0] * closing connection #0
08:43:01.947391 [0-0] * [HTTPS-CONNECT] close
08:43:01.949490 [0-0] * [SETUP] close
08:43:01.952020 [0-0] * [SETUP] destroy
08:43:01.954525 [0-0] * [HTTPS-CONNECT] destroy
curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_REVOCATION_OFFLINE (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline.

然后尝试访问证书里提供的 CRL 链接：

$ curl -v http://e5.c.lencr.org/80.crl
* Host e5.c.lencr.org:80 was resolved.
* IPv6: 2606:4700::6812:15d5, 2606:4700::6812:14d5
* IPv4: 104.18.20.213, 104.18.21.213
*   Trying [2606:4700::6812:15d5]:80...
* Connected to e5.c.lencr.org (2606:4700::6812:15d5) port 80
* using HTTP/1.x
> GET /80.crl HTTP/1.1
> Host: e5.c.lencr.org
> User-Agent: curl/8.10.1
> Accept: */*
>
* Request completely sent off
* Recv failure: Connection was reset
* closing connection #0
curl: (56) Recv failure: Connection was reset

itdog 查询显示这个域名已经完全被墙，方法是 TCP RST 。

部分浏览器可能不会检查 CRL ，那就没问题。但可能更多的正规浏览器或者 APP 会检查，就会导致无法访问或者弹出警告。

小站站长可能会痛苦了，很多人可能没法上你的网站了。

[vfs]

@Zy143L 我的和你不是一个节点， ：C:\Users\xxx>curl -v http://r11.c.lencr.org/46.crl
* Host r11.c.lencr.org:80 was resolved.
* IPv6: (none)
* IPv4: 104.18.21.213, 104.18.20.213
* Trying 104.18.21.213:80...
* Connected to r11.c.lencr.org (104.18.21.213) port 80
* using HTTP/1.x
> GET /46.crl HTTP/1.1
> Host: r11.c.lencr.org
> User-Agent: curl/8.13.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Date: Thu, 21 Aug 2025 01:02:01 GMT

[leoking6]

@fuzzsh 没有退役，只是 letsencrypt 宣布不再提供这个服务了。说是隐私考量，其实应该是成本扛不住了吧

[dnsjia]

https://ssl.dnsjia.com 支持申请多个证书

[Zy143L]

@vfs #41 R11 的确实没问题 但是 E5 确实寄了

[salmon5]

@DaDapeng #38 母鸡啊，反正企业业务使用 DigiCert ，CRL 和 OCSP 都是 digicert.cn 的；当然 GlobalSign 的 CRL 和 OCSP 也是全球加速的

[vibbow]

@villivateur 有 OCSP stapling 呀，服务器提前获取好就行

[zhanghua0]

@yokisama aur 那个是正在被打，已经发新闻解释了，以及提供了点缓解措施。

[Tink]

我之前都换成 zero SSL ，目前暂时还没啥问题

[journalist]

我试了 e5.c 必断，其他数字随机抽风，akamai （ c 换成 i ）没事，不知道可不可以在本地做个重定向 https://subdomainfinder.c99.nl/scans/2025-08-20/lencr.org

[e3c78a97e0f8]

只有 windows 下的 curl 用了 SChannel 有这个问题，Linux 下的 curl 根本不报错

[e3c78a97e0f8]

我看 zerossl.com 和 google.com 的证书 CRL 都是 pki.goog 域名上，这也是被墙的域名。那用 GTS ACME 和 ZeroSSL ACME 签发的证书 CRL 是不是也是 pki.goog 上？如果也是，那换 ACME provider 不能解决这个问题。

[AkinoKaedeChan]

至今难以理解为什么要 ban 这个…