Question

Your services validate peer certs in mTLS and, per a new security policy, now perform online revocation checking (OCSP) on every handshake. At 13:00 — no cert expired, no policy/cert change — a broad swath of internal mTLS handshakes start slowing to multi-second and then failing intermittently across many service pairs. Dashboards: peer certs are all valid and unexpired; the failures correlate with timeouts reaching an external OCSP responder URL; that responder is slow today. CPU/memory normal everywhere. How do you triage and mitigate?