Post heartbleed, the right way to go is for all browsers to deny https access in case the OCSP check fails, not just ignore the failure. The CAs are those who should scramble to fix whatever doesn't work. Captive networks have to be configured to allow CA access, or just disallow https.