Always prefer Certificate Revocation Lists (CRL) over Online Certificate Status Protocol (OCSP) responses (not recommended) ...