d directly by the CA it is issuing revocation information about (and it is correctly configured) then verification will succeed.</p>

<p>If the OCSP responder is a &quot;global responder&quot; which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example:</p>

<pre><code> openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem</code></pre>

<p>Alternatively the responder certificate itself can be explicitly tru