I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP stapling).
My specific web server of choice is Nginx - and there is the option ssl_trusted_certificate, which, if I'm not mistaken, allows an OCSP response's signature to be validated. As far as I know, this is a chain that goes from the CA's root certificate, down to the final intermediate certificate before your server's "acting" certificate (I forgot the proper name for these!).
In my specific situation, I'm using Gandi as a certificate provider. I got two different certification paths according to the test. The USERTRUST root (which issued the Gandi intermediate certificate), didn't seem to work on some devices (recent phones, I found an instance of Android 4.4.4 didn't have the certificate installed), so I opted for the longer chain, with AddTrust at the root (which issued a USERTRUST cert., which in turn issued the Gandi cert., and finally my server's own).
This resolved the issue. However, I'm wondering whether or not this is recommended to deviate from the given bundle provided by Gandi? Also, getting back to OCSP, my OCSP URI turns out to be http://ocsp.usertrust.com.
If I was just blindly changing ssl_trusted_certificate, I'd put the AddTrust root, the USERTRUST intermediate, and finally the Gandi intermediate certificates in that order (I can't find any documentation that goes into which order I specifically need it in, and which certificates I actually need to include).
If my OCSP responses are coming from USERTRUST, do I just need the USERTRUST root, and the Gandi intermediate?
Thanks for taking the time to read. :)