This site's OCSP certificate is invalid Topic is solved

[Mæstro]

A screenshot (in German) has been attached; this had appeared on accessing this forum. To access this site and report this, I had needed disable OCSP in the advanced settings. This error had appeared only today; all had worked as it ought to have yesterday.

[Moonchild]

Are you forcing OCSP verification and treating OCSP failures as errors? You shouldn't.

[Mæstro]

Yes, I use ordinarily the settings shown in the screenshot. To access this site, I had unticked both boxes. What is the purpose and intended use for these options?
(Curiously, the site appears now to work as normal, with these boxes ticked again. It would seem the error was momentary, so I see this question, unless the site lapses, as informative only.)

[Moonchild]

The second of the options is not recommended (and not the default in Pale Moon!). OCSP servers aren't always reliably available and it will fall back to standard certificate checks in that case.
You should not treat an OCSP failure as an invalid certificate unless you have explicit need for requiring revocation information to be checked and verified every time you access the server (some high sec environments do require this but as an end user you shouldn't need this).