What happens when a user's certificate is revoked and Apache checks revocation through OCSP?
Apache asks the responder, gets "revoked", aborts the TLS handshake, and the browser can no longer open the site; the error log records a certificate-revoked verification error.
Apache is told to check with
SSLOCSPEnable on
SSLOCSPDefaultResponder http://ws-XXX.gXXX.ckteck.com/ocsp
SSLOCSPUseRequestNonce on
After the certificate is revoked in the CA console, the CRL republished and the responder's revocation data refreshed, the next connection goes: browser presents the certificate, Apache sends an OCSP request, the responder answers revoked, Apache rejects the client certificate. The browser shows an SSL/connection error and the page stays closed.
In /var/log/apache2/error.log mod_ssl logs that certificate verification failed and gives OpenSSL's reason, "certificate revoked" (OpenSSL verify error 23), with the certificate's subject.
Two practical traps: browsers cache pages and TLS sessions, so test in a fresh private window; and without a manual CRL publish and responder refresh, the revocation only becomes visible at the next scheduled update.
Go deeper:
Apache: mod_ssl reference — SSLOCSPEnable,SSLOCSPDefaultResponderandSSLOCSPOverrideResponder.