I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses.
In a definition of certificate profile for OCSP Signer certificate, should I define CRL distribution points or AIA OCSP URI?
As for OCSP URI I think it does not make any sense as it would be pointing to the same URI where responses with the same OCSP certificate are signed. Then I can't trust OCSP response when asking if the OCSP Signer certificate is valid.
Using CRL distribution points may be usefull so anyone can check if the OCSP Signer certificate is valid through different path (channel).
Does it make sense for the OCSP Signed certificate to include CRL distibution points and OCSP URI?