As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?

1 Answer 1


OCSP responses may be signed not only by the CA itself, but also a designated OCSP signer. That's an X.509 certificate issued by that CA with the OCSPSigning ( extended key usage.

For details see RFC 6960, section

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .