Windows: How can I diagnose certificate revocation check failure, when I know the OK response is sent?

Solution 1:

The certutil.exe has a relatively new option, called -downloadocsp which you can use to verify the OCSP responses.

1. In a command prompt, create two folders, called certs and results.
2. Place your Exchange server certificates in the certs folder. If your using OCSP to check the CA certificate too, place a copy of the CA certificate in that folder.
3. Run certutil -downloadocsp certs results downloadonce. This will create a .ocsp file within results for each response.
4. Finally, run certutil results\????.ocsp to view each response as plaintext.

The above is from Mark Cooper's brilliant website.