> To be fair, they fully control the library they’re using, as they have their own x509 library and API in Core Foundation. But it also supports CRLs so I’m som

> To be fair, they fully control the library they’re using, as they have their own x509 library and API in Core Foundation. But it also supports CRLs so I’m somewhat circumspect this is the reason. yes. if of course it's their library. But I assume the caller was just calling some (imaginary) function like validate_cert(cert, ENABLE_ALL_CHECKS); and that was it. That ENABLE_ALL_CHECKS would then go out to check the OCSP server was probably not immediately known or was just seen as something that's part of, well, enabling all checks without much additional thought. Whether the certificate also lists a CRL endpoint and whether that imaginary ENABLE_ALL_CHECKS also checks that I don't know, but possibly neither did the person who called that (imaginary) function. Heck, the function might even default to ENABLE_ALL_CHECKS internally at which point the author of this code in question might not even have been aware of the network calls.