 the root CA of the OCSP responders CA is checked to see if it is trusted for OCSP signing. If it is the OCSP verify succeeds.</p>

<p>If none of these checks is successful then the OCSP verify fails.</p>

<p>What this effectively means if that if the OCSP responder certificate is authorised directly by the CA it is issuing revocation information about (and it is correctly configured) then verification will succeed.</p>

<p>If the OCSP responder is a &quot;global responder&quot; which can give details about