If your network deployment includes a web proxy, you can now use the Online Certificate Status Protocol (OCSP) to check the validity of SSL/TLS certificates. The firewall forwards OCSP requests to your proxy server instead of directly to the OCSP responder. You'll need to configure an OCSP responder and specify OCSP as your certificate revocation status method.