GlobalProtect is failing HIP Certificate Checks with Error "socket error 97 (Address family not supported by protocol)"

HIP certificate check was failing for GlobalProtect users and following error message was seen in PanGPS.log:

Debug( 599): Failed to connect to ocsp.sectigo.com on 80 with return value -1 and socket error 97(Address family not supported by protocol)
Info (1421): pan_ocsp_parse_response() failed

• Palo Alto Firewalls
• Supported PAN-OS versions
• GlobalProtect App
• HIP Object with Certificate check
• Certificate profile with OCSP check enabled

• OCSP Responder not reachable from the Client.
• DNS resolution failure.

Ensure the OCSP responder reachable for clients.

• HIP objects using certificate check category, the associated certificate profile with OCSP check enabled would show OCSP errors in PanGPS.log,
• When certificate profile with OCSP check enabled is used for client certificate authentication, OCSP check failures would be seen on firewall’s sslmgr.log, not on GP client side logs.