OpenSSL: OSCP certificate revocation support is useless
Currently the OpenSSL backend performs traditional OCSP to check whether a certificate is revoked, and accepts the certificate if the OCSP check fails, e.g. if the OCSP server is unreachable. This is long known to be pointless since a network adversary capable of hijacking your connection to a website is also surely capable of blocking your connection to the OCSP server.
I kinda just accepted this behavior from the OpenSSL backend at first since it was new and I figure some business folks had decided it must be this way, but now that it's starting to mature a bit it seems like a good time to clean up this behavior, because it's not justifiable. Either it should hard fail -- which nobody else does -- or should just do no OCSP at all (my suggestion).
Now for a proper solution for certificate revocation, #32 (closed), we might want to support stapled OCSP responses, where we don't contact the OCSP server but expect the TLS peer to do so. But note there is no point in waiting for work on #32 (closed) before removing the current security theater OCSP implementation.