I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate? If so that OCSP server should be signed by the a root ca (which the client can verify via its truststore) in order to not end up in an infinite loop, right?
I think that OCSP validation comes before certificate chain validation.
Any clarification would be great.