I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses.
I am confused at this point. I mean, even if there was a man in the middle impersonating the OCSP(which the purpose of signing messages), it can't do any harm, since it doesn't know the CA private key, so it can't sign arbitrary certificates, right ?
Second, how would the client even get the OCSP's public key, if it only knows the CA one ? It has to contact the CA, but a CA only communicate through its OCSP so an impersonator can still MITM and act as the OCSP anyway