I have an architecture with a root ca and a sub ca like this:
root ca > sub ca > server <----------> external client
The root ca delivers a certificate for the sub ca. The sub ca delivers a certificate for the internal server.
So I have two ocsp responders: one in the root ca and another in the sub ca.
My goal is to check the certification chain with ocsp from the external client.
I use the command:
openssl ocsp -issuer sub-ca.crt -CAfile sub-ca-and-ca_mere.crt -cert interne.crt -url http://ipa-ca.sub.cedricdomaine.fr/ca/ocsp
sub-ca.crt is the certificate for the sub ca.
sub-ca-and-ca_mere is the concatenation of sub ca certificate and root ca both.
interne.crt is the certificate for the server.
I wonder which url to use after the option -url because i have two ocsp responder: the sub ca's one or the root ca's one?