OCSP is default enabled in Firefox actually, so you're already doing that. Setting required to true just makes it actually demand a response instead of allowin

OCSP is default enabled in Firefox actually, so you're already doing that. Setting required to true just makes it actually demand a response instead of allowing an MITM to block it making OCSP ineffective. At the end of the day we need to start progressively rejecting certificates that aren't OCSP stapled to fix both sides of this, but for now this is the best fix available for technical people who understand how OCSP works.