OCSP is broken by design. Should turn it off for server applications. Maybe even disable it entirely when compiling openssl if possible. OCSP is to query rando

OCSP is broken by design. Should turn it off for server applications. Maybe even disable it entirely when compiling openssl if possible. OCSP is to query random CA web servers when opening a SSL connection to verify if the certificate in use was revoked. It's broken by design because servers simply don't have internet access.