Is it possible to allow OCSP requests using for example iptables or Squid? I'm doing an experiment where I reject insecure outgoing HTTP requests, but OCSP is of course a valid exception since the response is validated by the browser. Or is there at least some way to identify OCSP HTTP requests uniquely so as to write a custom filter for it?
Alternatively, is there an official list of IPs/subnets that are used for OCSP? This looks promising, since the author is forcing HTTPS in a different way, but there's no guarantee of it being maintained.