Why is OCSP must-staple secure?

Question

Trying to understand OCSP stapling and OCSP must-staple, I've read multiple explanations, but I still don't understand what makes OCSP must-staple secure.

My understanding is that, during TLS, the clients request the server certificate from the (web) server, and the server will send the certificate including the OCSP response for that certificate, and we call that stapling. The OCSP response has been retrieved by server from the OCSP responder whose URL is in the Certificate Authority Information Access extension of the certificate. The response is signed by the CA.

Provided that this is correct, I do not understand why the OCSP response cannot be faked?

If a MITM attacker would be able to exchange the certificate, wouldn't they be able to exchange the OCSP response, too? As explained in various places, the OCSP response is secure because it signed by the CA. But if the attacker was able to create a fake certificate signed by the CA (or a CA), why wouldn't they be able to do the same with a fake OCSP response? What am I missing here?

Answer 1

the OCSP response is signed by the CA issuing it. this is essentially the same as requesting the OCSP status from the CA yourself.

the signing with the key of the CA's OCSP key is what make sit so it can not be faked.

it does not protect against a malicious CA. as such it does not impact the security profile to have a OCSP stapled to the TLS handshake.

or in other words, the OCSP can not be faked because the malicious attacker does not have the key to sign his own OCSP with for his malicious CERT.

if the Attacker has a trusted CA that will sign any OCSP request for him... than this protection would be null and void. (as would any other PKI based protection aside from pinning)