Additional request in Firefox

[akshayranganath]

Firefox (and all browsers) implement what's called as OCSP stampling. This article explains the behavior: https://blog.mozilla.org/security/2013/0...-firefox/. It looks like the Firefox has been hardened to verify the TLS cert validity.

tl;dr; - The income tax site is not sending the certificate validity information and FF is defaulting to the OCSP check. This can be disabled through the browser's "about:config" setting. This will not be possible on WPT public instance.

For your use case, you could just block the domain and re-test. However, I'd suggest you to not do this. My suggestion would be to run 2 tests with the OCSP domains blocked and not blocked. You should consider both the response since some browsers (esp those behind corporate proxies) would be hardened to check for OCSP signatures.