I'm not very familiar with certificates, but Firefox enforces OCSP "must-staple", returning the MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING error if such a certificate is presented without a stapled OCSP response. OCSP must-staple is an extension that can be added to a certificate that tells the browser to expect an OCSP staple whenever it sees the certificate. This acts as an explicit signal to the browser that it’s safe to use the more secure hard-fail strategy. On the client side you can fix it by setting ''security.ssl.enable_ocsp_must_staple'' = '''false'''. See also [https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html this blog post].