This enables real-time OCSP (Online Certificate Status Protocol) revocation checking of the upstream server's certificate specifically during mutual authentication, catching a certificate that's been actively revoked even though it hasn't yet expired -- a check that certificate-time validation alone wouldn't catch. An admin enables this in higher-security deployments where a compromised server certificate needs to be immediately rejected the moment it's revoked, rather than remaining trusted until its natural expiry date. For example, if the upstream authentication server's certificate is revoked due to a suspected key compromise, enabling OCSP checking here means this switch will reject that server during its next mutual-authentication handshake even though the certificate's expiry date is still months away.