Information
Certificates should only be trusted if they have both a satisfactory trust chain and they have not been revoked. macOS can check whether the certificate is still valid based on issued parameters within the certificate.
Rationale:
A rogue or compromised certificate should not be trusted
Solution
Run the following commands to enforce the compliant state
To set the CRL settings:
defaults write com.apple.security.revocation CRLStyle -string RequireIfPresent
To set the OCSP settings:
defaults write com.apple.security.revocation OCSPStyle -string RequireIfPresent