Yes, OCSP is unencrypted (and uses HTTP). OCSP requests only include the certificate's serial number, however, and (AFAIK) Apple does not publish a directory of all issued certificates.
WRT the web PKI, though, yes, the serial number can be looked up in CT logs. Although that same "basic packet capture" will give you the hostname of the server -- at least until encrypted SNI is used everywhere.
(As for why OCSP is unencrypted, chicken and egg... rsponses are signed, however.)
WRT the web PKI, though, yes, the serial number can be looked up in CT logs. Although that same "basic packet capture" will give you the hostname of the server -- at least until encrypted SNI is used everywhere.
(As for why OCSP is unencrypted, chicken and egg... rsponses are signed, however.)