How to tell why macOS thinks that a certificate is revoked?

I tried crlrefresh rp and also manually deleting the OCSP cache with sudo rm /var/db/crls/*cache.db as documented by GlobalSign.

However, the cache seems to be in a different location on macOS 10.12 Sierra. The following command worked for me and resolved the problem:

$ sqlite3 ~/Library/Keychains/*/ocspcache.sqlite3 'DELETE FROM responses WHERE responderURI LIKE "%http://%.globalsign.com/%";'

I also tried deleting the whole database, but it does not seem to come back automatically.

If unsure, better just restore ~/Library/Keychains/*/ocspcache.sqlite3* (including -shm and -wal) from a backup before the OCSP servers started to give wrong replies, for example from yesterday.

Might be this, seems GlobalSign has got a problem with their OCSP. This is taken from their twitter (https://twitter.com/globalsign/status/786505261842247680?lang=da)

We are currently experiencing issues with our OCSP which is causing certificate warning messages. We aim to fix this as soon as possible.

And also

UPDATE: If you're a MAC user, please clear your cache with crlrefresh rp

or View and/or Delete CRL, OCSP Cache