As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?


OCSP responses may be signed not only by the CA itself, but also a designated OCSP signer. That's an X.509 certificate issued by that CA with the OCSPSigning ( extended key usage.

For details see RFC 6960, section

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.