A Palo Alto SSL decryption bypass fixes browsers and OCSP stapling still fails

Primary traffic works, yet certificate validation stays unreliable because the secondary OCSP path follows a different hostname and policy treatment.