OCSP status checker

A browser tab cannot open a raw TLS handshake to an arbitrary host, and OCSP responders do not send CORS headers, so no live probe happens here. That is why this page never states a revocation verdict and always reports stapling as unknown: both facts live on the server, not in the certificate. The openssl command in the result is the next step on a machine with network access, and it verifies the response signature, which a browser page cannot do either.