Check the status of the ocsp responder (here the class1 startssl variant). The -header option (supported by recent openssl versions) is needed for fixing HTTP/1.1, see http://www.math.ucla.edu/~jimc/documents/bugfix/21-openssl-ocsp.html!

check_ocsp_class1_startssl

#!/bin/sh
wget -q http://www.startssl.com/certs/sub.class1.server.ca.pem -O /tmp/sub.class1.server.ca.pem; \
    openssl ocsp -CAfile /tmp/sub.class1.server.ca.pem -issuer /tmp/sub.class1.server.ca.pem \ 
    -url http://ocsp.startssl.com/sub/class1/server/ca -noverify -no_nonce \
    -header "HOST" "ocsp.startssl.com" -cert ${1}

Thank you.

#!/bin/sh
#
# Display OCSP response.
#

# StartSSL Class 1
STARTSSL_CA_URL_CLASS1="http://www.startssl.com/certs/sub.class1.server.ca.pem"
STARTSSL_CA_CLASS1="./sub.class1.server.ca.pem"
STARTSSL_OCSP_URL_CLASS1="http://ocsp.startssl.com/sub/class1/server/ca"
STARTSSL_OCSP_HOST="ocsp.startssl.com"

CERT="$1"

[ -f "$CERT" ] || exit 1

if ! [ -r "$STARTSSL_CA_CLASS1" ]; then
    wget -nv -O "$STARTSSL_CA_CLASS1" "$STARTSSL_CA_URL_CLASS1"
fi

openssl ocsp -no_nonce \
    -CAfile "$STARTSSL_CA_CLASS1" -issuer "$STARTSSL_CA_CLASS1" \
    -header "Host" "$STARTSSL_OCSP_HOST" -url "$STARTSSL_OCSP_URL_CLASS1" \
    -cert "$CERT"