Firefox doesn't warn the user if SSL certificate doesn't include OCSP extension. I think this is a high security issue for the user as, if the site he is visiting is protected by a SSL certificate that doesn't include this extension he cannot know if the certificate is valid (It could have been revoked but the browser, if OCSP protocol is anabled, cannot contact the OCSP server of the certification authority), or rather, he will think that the connection is safe (and this is worse!).
I think this bug, together bug #331984, together the fact that only Firefox (that has maybe 20% of the browser market) has OCSP protocol enabled by default (MS Internet Explorer enables this only in Vista while Apple Safari doesn't enable it by default) makes world SSL connections virtually unsure.
Tested with Firefox 3.0.6 and Ubuntu Hardy Heron x86_64.