 multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example:</p>

<pre><code>openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem</code></pre>

<p>Alternatively the responder certificate itself can be explicitly trusted with the <b>-VAfile</b> option.</p>

<h1 id="NOTES">NOTES</h1>

<p>As noted, most of the verify options are for testing or debugging purposes. Normally only the <b>-CApath</b>, <b>-CAfile</b>, <b>-CAstore</b> and (if 