Re: OCSP/HTTPS site issues? Certificate validation?

[Rich Graves <rgraves () CARLETON EDU>]

Without specific examples (at least the CAs in question), no, it's not possible to help you. Try getting the CRL/OCSP 
site manually (browser, wget, openssl). If it fails, do basic network troubleshooting. If it succeeds, do basic 
troubleshooting on the machines affected. If it's intermittent, maybe the CA has underprovisioned their server. Check 
netflow/firewall logs for indications of failure. 

A mostly unrelated annoyance that people should be aware of: MacOS Lion turned on OCSP validation by default. If a 
captive portal redirects to a site with and SSL cert that provices OCSP/CRL information and the OCSP/CRL site itself is 
not available, not only is the captive portal broken, but the user's Keychain tends to get corrupted. 

Make sure your registration/quarantine networks allow CRL validation, or at least, don't redirect requests back to the 
captive portal.