From aa6ac2d665de95d3d9f17519d27c546912d9fd21 Mon Sep 17 00:00:00 2001
From: Derek Collison <derek@nats.io>
Date: Tue, 1 Aug 2023 21:48:02 -0700
Subject: [PATCH 01/14] Bump to 2.9.21-RC.4

Signed-off-by: Derek Collison <derek@nats.io>
---
 server/const.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/const.go b/server/const.go
index d614575e..576ef9bc 100644
--- a/server/const.go
+++ b/server/const.go
@@ -41,7 +41,7 @@ var (
 
 const (
 	// VERSION is the current version for the server.
-	VERSION = "2.9.21-RC.3"
+	VERSION = "2.9.21-RC.4"
 
 	// PROTO is the currently supported protocol.
 	// 0 was the original

From ba596f7de14056c819683a904de42c9c5fac9ca0 Mon Sep 17 00:00:00 2001
From: Waldemar Quevedo <wally@nats.io>
Date: Fri, 28 Jul 2023 15:46:11 -0700
Subject: [PATCH 02/14] config: make parsing configurations without usable
 values invalid

This makes configuration files that are empty, or read and processed
by the parser but with no detected values now return an error.

Signed-off-by: Waldemar Quevedo <wally@nats.io>
---
 conf/parse.go      |  4 +++-
 conf/parse_test.go | 27 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/conf/parse.go b/conf/parse.go
index 612b1643..4d2a20ad 100644
--- a/conf/parse.go
+++ b/conf/parse.go
@@ -146,7 +146,9 @@ func parse(data, fp string, pedantic bool) (p *parser, err error) {
 			return nil, err
 		}
 	}
-
+	if len(p.mapping) == 0 {
+		return nil, fmt.Errorf("config has no values or is empty")
+	}
 	return p, nil
 }
 
diff --git a/conf/parse_test.go b/conf/parse_test.go
index 4c8c07fb..3fc7c927 100644
--- a/conf/parse_test.go
+++ b/conf/parse_test.go
@@ -403,3 +403,30 @@ func TestParserNoInfiniteLoop(t *testing.T) {
 		}
 	}
 }
+
+func TestParseWithNoValues(t *testing.T) {
+	for _, test := range []string{
+		``,
+		`aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`,
+		`              aaaaaaaaaaaaaaaaaaaaaaaaaaa`,
+		`     aaaaaaaaaaaaaaaaaaaaaaaaaaa         `,
+		`
+                # just comments with no values
+                # is also invalid.
+                `,
+		`
+                # with comments and no spaces to create key values
+                # is also an invalid config.
+                aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+                `,
+		`
+                a,a,a,a,a,a,a,a,a,a,a
+                `,
+	} {
+		if _, err := parse(test, "", true); err == nil {
+			t.Fatal("expected an error")
+		} else if !strings.Contains(err.Error(), "config has no values or is empty") {
+			t.Fatal("expected invalid conf error")
+		}
+	}
+}

From 13cb62e0bf1da8544dcfe34d4b827ebd417b19a4 Mon Sep 17 00:00:00 2001
From: Waldemar Quevedo <wally@synadia.com>
Date: Fri, 21 Jul 2023 00:05:29 -0700
Subject: [PATCH 03/14] Add test checking subscriptions before/after reload

Signed-off-by: Waldemar Quevedo <wally@synadia.com>
---
 server/reload_test.go | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/server/reload_test.go b/server/reload_test.go
index 3f64fa4f..0b42bafb 100644
--- a/server/reload_test.go
+++ b/server/reload_test.go
@@ -2700,6 +2700,42 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 	})
 }
 
+func TestConfigReloadAccountWithNoChanges(t *testing.T) {
+	conf := createConfFile(t, []byte(`
+	listen: "127.0.0.1:-1"
+        system_account: sys
+	accounts {
+		A {
+			users = [{ user: a }]
+		}
+		B {
+			users = [{ user: b }]
+		}
+		C {
+			users = [{ user: c }]
+		}
+		sys {
+			users = [{ user: sys }]
+		}
+	}
+	`))
+	s, _ := RunServerWithConfig(conf)
+	defer s.Shutdown()
+	before := s.NumSubscriptions()
+	s.Reload()
+	after := s.NumSubscriptions()
+	if before != after {
+		t.Errorf("Number of subscriptions changed after reload: %d -> %d", before, after)
+	}
+
+	before = s.NumSubscriptions()
+	s.Reload()
+	after = s.NumSubscriptions()
+	if before != after {
+		t.Errorf("Number of subscriptions changed after reload: %d -> %d", before, after)
+	}
+}
+
 func TestConfigReloadAccountNKeyUsers(t *testing.T) {
 	conf := createConfFile(t, []byte(`
 	listen: "127.0.0.1:-1"

From 2b252469caf0b4cba24a4e3faac22c27e1262548 Mon Sep 17 00:00:00 2001
From: Waldemar Quevedo <wally@nats.io>
Date: Tue, 1 Aug 2023 22:51:21 -0700
Subject: [PATCH 04/14] fix: add missing default service imports on reload

Signed-off-by: Waldemar Quevedo <wally@nats.io>
---
 server/reload_test.go | 52 ++++++++++++++++++++++++++++++++++++++-----
 server/server.go      |  3 +++
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/server/reload_test.go b/server/reload_test.go
index 0b42bafb..1ea66194 100644
--- a/server/reload_test.go
+++ b/server/reload_test.go
@@ -2603,6 +2603,23 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 		t.Fatalf("Error on subscribe: %v", err)
 	}
 
+	// confirm subscriptions before and after reload.
+	var expectedSubs uint32 = 4
+	sAcc, _ := s.LookupAccount("synadia")
+	sAcc.mu.RLock()
+	n := sAcc.sl.Count()
+	sAcc.mu.RUnlock()
+	if n != expectedSubs {
+		t.Errorf("Synadia account should have %d sub, got %v", expectedSubs, n)
+	}
+	nAcc, _ := s.LookupAccount("nats.io")
+	nAcc.mu.RLock()
+	n = nAcc.sl.Count()
+	nAcc.mu.RUnlock()
+	if n != expectedSubs {
+		t.Errorf("Nats.io account should have %d sub, got %v", expectedSubs, n)
+	}
+
 	// Remove user from account and whole account
 	reloadUpdateConfig(t, s, conf, `
 	listen: "127.0.0.1:-1"
@@ -2678,8 +2695,8 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 		n = sAcc.sl.Count()
 		barMatch := sAcc.sl.Match("bar")
 		sAcc.mu.RUnlock()
-		if n != 1 {
-			return fmt.Errorf("Synadia account should have 1 sub, got %v", n)
+		if n != expectedSubs {
+			return fmt.Errorf("Synadia account should have %d sub, got %v", expectedSubs, n)
 		}
 		if len(barMatch.psubs) != 1 {
 			return fmt.Errorf("Synadia account should have bar sub")
@@ -2690,8 +2707,8 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 		n = nAcc.sl.Count()
 		batMatch := nAcc.sl.Match("bat")
 		nAcc.mu.RUnlock()
-		if n != 1 {
-			return fmt.Errorf("Nats.io account should have 1 sub, got %v", n)
+		if n != expectedSubs {
+			return fmt.Errorf("Nats.io account should have %d sub, got %v", expectedSubs, n)
 		}
 		if len(batMatch.psubs) != 1 {
 			return fmt.Errorf("Synadia account should have bar sub")
@@ -2719,8 +2736,24 @@ func TestConfigReloadAccountWithNoChanges(t *testing.T) {
 		}
 	}
 	`))
-	s, _ := RunServerWithConfig(conf)
+	s, opts := RunServerWithConfig(conf)
 	defer s.Shutdown()
+
+	ncA, err := nats.Connect(fmt.Sprintf("nats://a:@%s:%d", opts.Host, opts.Port))
+	if err != nil {
+		t.Fatalf("Error on connect: %v", err)
+	}
+	defer ncA.Close()
+
+	// Confirm service imports are ok.
+	resp, err := ncA.Request("$SYS.REQ.ACCOUNT.PING.CONNZ", nil, time.Second)
+	if err != nil {
+		t.Error(err)
+	}
+	if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
+		t.Fatal("unexpected data in connz response")
+	}
+
 	before := s.NumSubscriptions()
 	s.Reload()
 	after := s.NumSubscriptions()
@@ -2728,6 +2761,15 @@ func TestConfigReloadAccountWithNoChanges(t *testing.T) {
 		t.Errorf("Number of subscriptions changed after reload: %d -> %d", before, after)
 	}
 
+	// Confirm this still works...
+	resp, err = ncA.Request("$SYS.REQ.ACCOUNT.PING.CONNZ", nil, time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
+		t.Fatal("unexpected data in connz response")
+	}
+
 	before = s.NumSubscriptions()
 	s.Reload()
 	after = s.NumSubscriptions()
diff --git a/server/server.go b/server/server.go
index ea6d08ef..c3885e3e 100644
--- a/server/server.go
+++ b/server/server.go
@@ -900,6 +900,9 @@ func (s *Server) configureAccounts(reloading bool) (map[string]struct{}, error)
 			c.processUnsub(sid)
 		}
 		acc.addAllServiceImportSubs()
+		s.mu.Unlock()
+		s.registerSystemImports(acc)
+		s.mu.Lock()
 	}
 
 	// Set the system account if it was configured.

From 23b5cb959c2934a03ee9b938bfc714592fe6ae78 Mon Sep 17 00:00:00 2001
From: Waldemar Quevedo <wally@nats.io>
Date: Wed, 2 Aug 2023 08:51:08 -0700
Subject: [PATCH 05/14] review fixes

Signed-off-by: Waldemar Quevedo <wally@nats.io>
---
 server/reload_test.go | 64 +++++++++++++++++++++++++++++--------------
 1 file changed, 44 insertions(+), 20 deletions(-)

diff --git a/server/reload_test.go b/server/reload_test.go
index 1ea66194..94617900 100644
--- a/server/reload_test.go
+++ b/server/reload_test.go
@@ -2605,14 +2605,16 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 
 	// confirm subscriptions before and after reload.
 	var expectedSubs uint32 = 4
-	sAcc, _ := s.LookupAccount("synadia")
+	sAcc, err := s.LookupAccount("synadia")
+	require_NoError(t, err)
 	sAcc.mu.RLock()
 	n := sAcc.sl.Count()
 	sAcc.mu.RUnlock()
 	if n != expectedSubs {
 		t.Errorf("Synadia account should have %d sub, got %v", expectedSubs, n)
 	}
-	nAcc, _ := s.LookupAccount("nats.io")
+	nAcc, err := s.LookupAccount("nats.io")
+	require_NoError(t, err)
 	nAcc.mu.RLock()
 	n = nAcc.sl.Count()
 	nAcc.mu.RUnlock()
@@ -2671,7 +2673,8 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 	// being reconnected does not mean that resent of subscriptions
 	// has already been processed.
 	checkFor(t, 2*time.Second, 100*time.Millisecond, func() error {
-		gAcc, _ := s.LookupAccount(globalAccountName)
+		gAcc, err := s.LookupAccount(globalAccountName)
+		require_NoError(t, err)
 		gAcc.mu.RLock()
 		n := gAcc.sl.Count()
 		fooMatch := gAcc.sl.Match("foo")
@@ -2690,10 +2693,12 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 			return fmt.Errorf("Global account should have baz sub")
 		}
 
-		sAcc, _ := s.LookupAccount("synadia")
+		sAcc, err := s.LookupAccount("synadia")
+		require_NoError(t, err)
 		sAcc.mu.RLock()
 		n = sAcc.sl.Count()
 		barMatch := sAcc.sl.Match("bar")
+
 		sAcc.mu.RUnlock()
 		if n != expectedSubs {
 			return fmt.Errorf("Synadia account should have %d sub, got %v", expectedSubs, n)
@@ -2702,7 +2707,8 @@ func TestConfigReloadAccountUsers(t *testing.T) {
 			return fmt.Errorf("Synadia account should have bar sub")
 		}
 
-		nAcc, _ := s.LookupAccount("nats.io")
+		nAcc, err := s.LookupAccount("nats.io")
+		require_NoError(t, err)
 		nAcc.mu.RLock()
 		n = nAcc.sl.Count()
 		batMatch := nAcc.sl.Match("bat")
@@ -2745,15 +2751,31 @@ func TestConfigReloadAccountWithNoChanges(t *testing.T) {
 	}
 	defer ncA.Close()
 
-	// Confirm service imports are ok.
-	resp, err := ncA.Request("$SYS.REQ.ACCOUNT.PING.CONNZ", nil, time.Second)
-	if err != nil {
-		t.Error(err)
+	// Confirm default service imports are ok.
+	checkSubs := func(t *testing.T) {
+		resp, err := ncA.Request("$SYS.REQ.ACCOUNT.PING.CONNZ", nil, time.Second)
+		if err != nil {
+			t.Error(err)
+		}
+		if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
+			t.Fatal("unexpected data in connz response")
+		}
+		resp, err = ncA.Request("$SYS.REQ.SERVER.PING.CONNZ", nil, time.Second)
+		if err != nil {
+			t.Error(err)
+		}
+		if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
+			t.Fatal("unexpected data in connz response")
+		}
+		resp, err = ncA.Request("$SYS.REQ.ACCOUNT.PING.STATZ", nil, time.Second)
+		if err != nil {
+			t.Error(err)
+		}
+		if resp == nil || !strings.Contains(string(resp.Data), `"conns":1`) {
+			t.Fatal("unexpected data in connz response")
+		}
 	}
-	if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
-		t.Fatal("unexpected data in connz response")
-	}
-
+	checkSubs(t)
 	before := s.NumSubscriptions()
 	s.Reload()
 	after := s.NumSubscriptions()
@@ -2761,15 +2783,17 @@ func TestConfigReloadAccountWithNoChanges(t *testing.T) {
 		t.Errorf("Number of subscriptions changed after reload: %d -> %d", before, after)
 	}
 
-	// Confirm this still works...
-	resp, err = ncA.Request("$SYS.REQ.ACCOUNT.PING.CONNZ", nil, time.Second)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if resp == nil || !strings.Contains(string(resp.Data), `"num_connections":1`) {
-		t.Fatal("unexpected data in connz response")
+	// Confirm this still works after a reload...
+	checkSubs(t)
+	before = s.NumSubscriptions()
+	s.Reload()
+	after = s.NumSubscriptions()
+	if before != after {
+		t.Errorf("Number of subscriptions changed after reload: %d -> %d", before, after)
 	}
 
+	// Do another extra reload just in case.
+	checkSubs(t)
 	before = s.NumSubscriptions()
 	s.Reload()
 	after = s.NumSubscriptions()

From 209fcd70eb3a4c570fc60acd25073686a56b67cf Mon Sep 17 00:00:00 2001
From: Todd Beets <todd@beetsme.net>
Date: Wed, 2 Aug 2023 11:25:48 -0700
Subject: [PATCH 06/14] OCSP Peer Feature

---
 server/certidp/certidp.go                     |  297 ++
 server/certidp/messages.go                    |  106 +
 server/certidp/ocsp_responder.go              |   83 +
 server/client.go                              |    1 +
 server/events.go                              |  105 +
 server/monitor.go                             |  177 +-
 server/monitor_test.go                        |    5 +-
 server/ocsp.go                                |  139 +-
 server/ocsp_peer.go                           |  405 +++
 server/ocsp_responsecache.go                  |  636 ++++
 server/opts.go                                |   69 +-
 server/reload.go                              |   27 +-
 server/server.go                              |   25 +-
 .../ocsp_peer/mini-ca/caocsp/caocsp_cert.pem  |   91 +
 .../mini-ca/caocsp/private/caocsp_keypair.pem |   28 +
 .../mini-ca/client1/System_bundle.pem         |  186 ++
 .../ocsp_peer/mini-ca/client1/System_cert.pem |   97 +
 .../mini-ca/client1/UserA1_bundle.pem         |  186 ++
 .../ocsp_peer/mini-ca/client1/UserA1_cert.pem |   97 +
 .../mini-ca/client1/UserA2_bundle.pem         |  186 ++
 .../ocsp_peer/mini-ca/client1/UserA2_cert.pem |   97 +
 .../ocsp_peer/mini-ca/client1/certfile.pem    |  175 +
 .../client1/private/System_keypair.pem        |   28 +
 .../client1/private/UserA1_keypair.pem        |   28 +
 .../client1/private/UserA2_keypair.pem        |   28 +
 .../mini-ca/client2/UserB1_bundle.pem         |  186 ++
 .../ocsp_peer/mini-ca/client2/UserB1_cert.pem |   97 +
 .../mini-ca/client2/UserB2_bundle.pem         |  186 ++
 .../ocsp_peer/mini-ca/client2/UserB2_cert.pem |   97 +
 .../ocsp_peer/mini-ca/client2/certfile.pem    |  175 +
 .../client2/private/UserB1_keypair.pem        |   28 +
 .../client2/private/UserB2_keypair.pem        |   28 +
 .../intermediate1/intermediate1_cert.pem      |   89 +
 .../private/intermediate1_keypair.pem         |   28 +
 .../intermediate2/intermediate2_cert.pem      |   89 +
 .../private/intermediate2_keypair.pem         |   28 +
 .../ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem  |  181 ++
 .../ocsp_peer/mini-ca/ocsp1/ocsp1_cert.pem    |   92 +
 .../mini-ca/ocsp1/private/ocsp1_keypair.pem   |   28 +
 .../ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem  |  181 ++
 .../ocsp_peer/mini-ca/ocsp2/ocsp2_cert.pem    |   92 +
 .../mini-ca/ocsp2/private/ocsp2_keypair.pem   |   28 +
 .../mini-ca/root/private/root_keypair.pem     |   28 +
 .../ocsp_peer/mini-ca/root/root_cert.pem      |   86 +
 .../mini-ca/server1/TestServer1_bundle.pem    |  186 ++
 .../mini-ca/server1/TestServer1_cert.pem      |   97 +
 .../mini-ca/server1/TestServer2_bundle.pem    |  186 ++
 .../mini-ca/server1/TestServer2_cert.pem      |   97 +
 .../server1/private/TestServer1_keypair.pem   |   28 +
 .../server1/private/TestServer2_keypair.pem   |   28 +
 test/ocsp_peer_test.go                        | 2875 +++++++++++++++++
 test/ocsp_test.go                             |   53 +-
 52 files changed, 8462 insertions(+), 137 deletions(-)
 create mode 100644 server/certidp/certidp.go
 create mode 100644 server/certidp/messages.go
 create mode 100644 server/certidp/ocsp_responder.go
 create mode 100644 server/ocsp_peer.go
 create mode 100644 server/ocsp_responsecache.go
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/caocsp/caocsp_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/caocsp/private/caocsp_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/System_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/System_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/certfile.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/private/System_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA2_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/certfile.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB2_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/intermediate1/private/intermediate1_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/intermediate2/private/intermediate2_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/ocsp2/private/ocsp2_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/root/private/root_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/root/root_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem
 create mode 100644 test/ocsp_peer_test.go

diff --git a/server/certidp/certidp.go b/server/certidp/certidp.go
new file mode 100644
index 00000000..f7b660df
--- /dev/null
+++ b/server/certidp/certidp.go
@@ -0,0 +1,297 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package certidp
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ocsp"
+)
+
+const (
+	DefaultAllowedClockSkew     = 30 * time.Second
+	DefaultOCSPResponderTimeout = 2 * time.Second
+	DefaultTTLUnsetNextUpdate   = 1 * time.Hour
+)
+
+type StatusAssertion int
+
+var (
+	StatusAssertionStrToVal = map[string]StatusAssertion{
+		"good":    ocsp.Good,
+		"revoked": ocsp.Revoked,
+		"unknown": ocsp.Unknown,
+	}
+	StatusAssertionValToStr = map[StatusAssertion]string{
+		ocsp.Good:    "good",
+		ocsp.Revoked: "revoked",
+		ocsp.Unknown: "unknown",
+	}
+	StatusAssertionIntToVal = map[int]StatusAssertion{
+		0: ocsp.Good,
+		1: ocsp.Revoked,
+		2: ocsp.Unknown,
+	}
+)
+
+func GetStatusAssertionStr(sa int) string {
+	return StatusAssertionValToStr[StatusAssertionIntToVal[sa]]
+}
+
+func (sa StatusAssertion) MarshalJSON() ([]byte, error) {
+	str, ok := StatusAssertionValToStr[sa]
+	if !ok {
+		// set unknown as fallback
+		str = StatusAssertionValToStr[ocsp.Unknown]
+	}
+	return json.Marshal(str)
+}
+
+func (sa *StatusAssertion) UnmarshalJSON(in []byte) error {
+	v, ok := StatusAssertionStrToVal[strings.ReplaceAll(string(in), "\"", "")]
+	if !ok {
+		// set unknown as fallback
+		v = StatusAssertionStrToVal["unknown"]
+	}
+	*sa = v
+	return nil
+}
+
+type ChainLink struct {
+	Leaf             *x509.Certificate
+	Issuer           *x509.Certificate
+	OCSPWebEndpoints *[]*url.URL
+}
+
+// OCSPPeerConfig holds the parsed OCSP peer configuration section of TLS configuration
+type OCSPPeerConfig struct {
+	Verify                 bool
+	Timeout                float64
+	ClockSkew              float64
+	WarnOnly               bool
+	UnknownIsGood          bool
+	AllowWhenCAUnreachable bool
+	TTLUnsetNextUpdate     float64
+}
+
+func NewOCSPPeerConfig() *OCSPPeerConfig {
+	return &OCSPPeerConfig{
+		Verify:                 false,
+		Timeout:                DefaultOCSPResponderTimeout.Seconds(),
+		ClockSkew:              DefaultAllowedClockSkew.Seconds(),
+		WarnOnly:               false,
+		UnknownIsGood:          false,
+		AllowWhenCAUnreachable: false,
+		TTLUnsetNextUpdate:     DefaultTTLUnsetNextUpdate.Seconds(),
+	}
+}
+
+// Log is a neutral method of passing server loggers to plugins
+type Log struct {
+	Debugf  func(format string, v ...interface{})
+	Noticef func(format string, v ...interface{})
+	Warnf   func(format string, v ...interface{})
+	Errorf  func(format string, v ...interface{})
+	Tracef  func(format string, v ...interface{})
+}
+
+type CertInfo struct {
+	Subject     string `json:"subject,omitempty"`
+	Issuer      string `json:"issuer,omitempty"`
+	Fingerprint string `json:"fingerprint,omitempty"`
+	Raw         []byte `json:"raw,omitempty"`
+}
+
+var OCSPPeerUsage = `
+For client, leaf spoke (remotes), and leaf hub connections, you may enable OCSP peer validation:
+
+    tls {
+        ...
+        # mTLS must be enabled (with exception of Leaf remotes)
+        verify: true
+        ...
+        # short form enables peer verify and takes option defaults
+        ocsp_peer: true
+        
+        # long form includes settable options
+        ocsp_peer {
+           # Enable OCSP peer validation (default false)
+           verify: true
+
+           # OCSP responder timeout in seconds (may be fractional, default 2 seconds)
+           ca_timeout: 2
+
+           # Allowed skew between server and OCSP responder time in seconds (may be fractional, default 30 seconds)
+           allowed_clockskew: 30
+
+           # Warn-only and never reject connections (default false)
+           warn_only: false
+
+           # Treat response Unknown status as valid certificate (default false)
+           unknown_is_good: false
+
+           # Warn-only if no CA response can be obtained and no cached revocation exists (default false)
+           allow_when_ca_unreachable: false
+
+           # If response NextUpdate unset by CA, set a default cache TTL in seconds from ThisUpdate (default 1 hour)
+           cache_ttl_when_next_update_unset: 3600
+        }
+        ...
+    }
+
+Note: OCSP validation for route and gateway connections is enabled using the 'ocsp' configuration option.
+`
+
+// GenerateFingerprint returns a base64-encoded SHA256 hash of the raw certificate
+func GenerateFingerprint(cert *x509.Certificate) string {
+	data := sha256.Sum256(cert.Raw)
+	return base64.StdEncoding.EncodeToString(data[:])
+}
+
+func getWebEndpoints(uris []string) []*url.URL {
+	var urls []*url.URL
+	for _, uri := range uris {
+		endpoint, err := url.ParseRequestURI(uri)
+		if err != nil {
+			// skip invalid URLs
+			continue
+		}
+		if endpoint.Scheme != "http" && endpoint.Scheme != "https" {
+			// skip non-web URLs
+			continue
+		}
+		urls = append(urls, endpoint)
+	}
+	return urls
+}
+
+// GetSubjectDNForm returns RDN sequence concatenation of the certificate's subject to be
+// used in logs, events, etc. Should never be used for reliable cache matching or other crypto purposes.
+func GetSubjectDNForm(cert *x509.Certificate) string {
+	if cert == nil {
+		return ""
+	}
+	return strings.TrimSuffix(fmt.Sprintf("%s+", cert.Subject.ToRDNSequence()), "+")
+}
+
+// GetIssuerDNForm returns RDN sequence concatenation of the certificate's issuer to be
+// used in logs, events, etc. Should never be used for reliable cache matching or other crypto purposes.
+func GetIssuerDNForm(cert *x509.Certificate) string {
+	if cert == nil {
+		return ""
+	}
+	return strings.TrimSuffix(fmt.Sprintf("%s+", cert.Issuer.ToRDNSequence()), "+")
+}
+
+// CertOCSPEligible checks if the certificate's issuer has populated AIA with OCSP responder endpoint(s)
+// and is thus eligible for OCSP validation
+func CertOCSPEligible(link *ChainLink) bool {
+	if link == nil || link.Leaf.Raw == nil || len(link.Leaf.Raw) == 0 {
+		return false
+	}
+	if link.Leaf.OCSPServer == nil || len(link.Leaf.OCSPServer) == 0 {
+		return false
+	}
+	urls := getWebEndpoints(link.Leaf.OCSPServer)
+	if len(urls) == 0 {
+		return false
+	}
+	link.OCSPWebEndpoints = &urls
+	return true
+}
+
+// GetLeafIssuerCert returns the issuer certificate of the leaf (positional) certificate in the chain
+func GetLeafIssuerCert(chain []*x509.Certificate, leafPos int) *x509.Certificate {
+	if len(chain) == 0 || leafPos < 0 {
+		return nil
+	}
+	// self-signed certificate or too-big leafPos
+	if leafPos >= len(chain)-1 {
+		return nil
+	}
+	// returns pointer to issuer cert or nil
+	return (chain)[leafPos+1]
+}
+
+// OCSPResponseCurrent checks if the OCSP response is current (i.e. not expired and not future effective)
+func OCSPResponseCurrent(ocspr *ocsp.Response, opts *OCSPPeerConfig, log *Log) bool {
+	skew := time.Duration(opts.ClockSkew * float64(time.Second))
+	if skew < 0*time.Second {
+		skew = DefaultAllowedClockSkew
+	}
+	now := time.Now().UTC()
+	// Typical effectivity check based on CA response ThisUpdate and NextUpdate semantics
+	if !ocspr.NextUpdate.IsZero() && ocspr.NextUpdate.Before(now.Add(-1*skew)) {
+		t := ocspr.NextUpdate.Format(time.RFC3339Nano)
+		nt := now.Format(time.RFC3339Nano)
+		log.Debugf(DbgResponseExpired, t, nt, skew)
+		return false
+	}
+	// CA responder can assert NextUpdate unset, in which case use config option to set a default cache TTL
+	if ocspr.NextUpdate.IsZero() {
+		ttl := time.Duration(opts.TTLUnsetNextUpdate * float64(time.Second))
+		if ttl < 0*time.Second {
+			ttl = DefaultTTLUnsetNextUpdate
+		}
+		expiryTime := ocspr.ThisUpdate.Add(ttl)
+		if expiryTime.Before(now.Add(-1 * skew)) {
+			t := expiryTime.Format(time.RFC3339Nano)
+			nt := now.Format(time.RFC3339Nano)
+			log.Debugf(DbgResponseTTLExpired, t, nt, skew)
+			return false
+		}
+	}
+	if ocspr.ThisUpdate.After(now.Add(skew)) {
+		t := ocspr.ThisUpdate.Format(time.RFC3339Nano)
+		nt := now.Format(time.RFC3339Nano)
+		log.Debugf(DbgResponseFutureDated, t, nt, skew)
+		return false
+	}
+	return true
+}
+
+// ValidDelegationCheck checks if the CA OCSP Response was signed by a valid CA Issuer delegate as per (RFC 6960, section 4.2.2.2)
+// If a valid delegate or direct-signed by CA Issuer, true returned.
+func ValidDelegationCheck(iss *x509.Certificate, ocspr *ocsp.Response) bool {
+	// This call assumes prior successful parse and signature validation of the OCSP response
+	// The Go OCSP library (as of x/crypto/ocsp v0.9) will detect and perform a 1-level delegate signature check but does not
+	// implement the additional criteria for delegation specified in RFC 6960, section 4.2.2.2.
+	if iss == nil || ocspr == nil {
+		return false
+	}
+	// not a delegation, no-op
+	if ocspr.Certificate == nil {
+		return true
+	}
+	// delegate is self-same with CA Issuer, not a delegation although response issued in that form
+	if ocspr.Certificate.Equal(iss) {
+		return true
+	}
+	// we need to verify CA Issuer stamped id-kp-OCSPSigning on delegate
+	delegatedSigner := false
+	for _, keyUseExt := range ocspr.Certificate.ExtKeyUsage {
+		if keyUseExt == x509.ExtKeyUsageOCSPSigning {
+			delegatedSigner = true
+			break
+		}
+	}
+	return delegatedSigner
+}
diff --git a/server/certidp/messages.go b/server/certidp/messages.go
new file mode 100644
index 00000000..52a799ac
--- /dev/null
+++ b/server/certidp/messages.go
@@ -0,0 +1,106 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package certidp
+
+var (
+	// Returned errors
+	ErrIllegalPeerOptsConfig              = "expected map to define OCSP peer options, got [%T]"
+	ErrIllegalCacheOptsConfig             = "expected map to define OCSP peer cache options, got [%T]"
+	ErrParsingPeerOptFieldGeneric         = "error parsing tls peer config, unknown field [%q]"
+	ErrParsingPeerOptFieldTypeConversion  = "error parsing tls peer config, conversion error: %s"
+	ErrParsingCacheOptFieldTypeConversion = "error parsing OCSP peer cache config, conversion error: %s"
+	ErrUnableToPlugTLSEmptyConfig         = "unable to plug TLS verify connection, config is nil"
+	ErrMTLSRequired                       = "OCSP peer verification for client connections requires TLS verify (mTLS) to be enabled"
+	ErrUnableToPlugTLSClient              = "unable to register client OCSP verification"
+	ErrUnableToPlugTLSServer              = "unable to register server OCSP verification"
+	ErrCannotWriteCompressed              = "error writing to compression writer: %w"
+	ErrCannotReadCompressed               = "error reading compression reader: %w"
+	ErrTruncatedWrite                     = "short write on body (%d != %d)"
+	ErrCannotCloseWriter                  = "error closing compression writer: %w"
+	ErrParsingCacheOptFieldGeneric        = "error parsing OCSP peer cache config, unknown field [%q]"
+	ErrUnknownCacheType                   = "error parsing OCSP peer cache config, unknown type [%s]"
+	ErrInvalidChainlink                   = "invalid chain link"
+	ErrBadResponderHTTPStatus             = "bad OCSP responder http status: [%d]"
+	ErrNoAvailOCSPServers                 = "no available OCSP servers"
+	ErrFailedWithAllRequests              = "exhausted OCSP responders: %w"
+
+	// Direct logged errors
+	ErrLoadCacheFail          = "Unable to load OCSP peer cache: %s"
+	ErrSaveCacheFail          = "Unable to save OCSP peer cache: %s"
+	ErrBadCacheTypeConfig     = "Unimplemented OCSP peer cache type [%v]"
+	ErrResponseCompressFail   = "Unable to compress OCSP response for key [%s]: %s"
+	ErrResponseDecompressFail = "Unable to decompress OCSP response for key [%s]: %s"
+	ErrPeerEmptyNoEvent       = "Peer certificate is nil, cannot send OCSP peer reject event"
+	ErrPeerEmptyAutoReject    = "Peer certificate is nil, rejecting OCSP peer"
+
+	// Debug information
+	DbgPlugTLSForKind        = "Plugging TLS OCSP peer for [%s]"
+	DbgNumServerChains       = "Peer OCSP enabled: %d TLS server chain(s) will be evaluated"
+	DbgNumClientChains       = "Peer OCSP enabled: %d TLS client chain(s) will be evaluated"
+	DbgLinksInChain          = "Chain [%d]: %d total link(s)"
+	DbgSelfSignedValid       = "Chain [%d] is self-signed, thus peer is valid"
+	DbgValidNonOCSPChain     = "Chain [%d] has no OCSP eligible links, thus peer is valid"
+	DbgChainIsOCSPEligible   = "Chain [%d] has %d OCSP eligible link(s)"
+	DbgChainIsOCSPValid      = "Chain [%d] is OCSP valid for all eligible links, thus peer is valid"
+	DbgNoOCSPValidChains     = "No OCSP valid chains, thus peer is invalid"
+	DbgCheckingCacheForCert  = "Checking OCSP peer cache for [%s], key [%s]"
+	DbgCurrentResponseCached = "Cached OCSP response is current, status [%s]"
+	DbgExpiredResponseCached = "Cached OCSP response is expired, status [%s]"
+	DbgOCSPValidPeerLink     = "OCSP verify pass for [%s]"
+	DbgCachingResponse       = "Caching OCSP response for [%s], key [%s]"
+	DbgAchievedCompression   = "OCSP response compression ratio: [%f]"
+	DbgCacheHit              = "OCSP peer cache hit for key [%s]"
+	DbgCacheMiss             = "OCSP peer cache miss for key [%s]"
+	DbgPreservedRevocation   = "Revoked OCSP response for key [%s] preserved by cache policy"
+	DbgDeletingCacheResponse = "Deleting OCSP peer cached response for key [%s]"
+	DbgStartingCache         = "Starting OCSP peer cache"
+	DbgStoppingCache         = "Stopping OCSP peer cache"
+	DbgLoadingCache          = "Loading OCSP peer cache [%s]"
+	DbgNoCacheFound          = "No OCSP peer cache found, starting with empty cache"
+	DbgSavingCache           = "Saving OCSP peer cache [%s]"
+	DbgCacheSaved            = "Saved OCSP peer cache successfully (%d bytes)"
+	DbgMakingCARequest       = "Trying OCSP responder url [%s]"
+	DbgResponseExpired       = "OCSP response NextUpdate [%s] is before now [%s] with clockskew [%s]"
+	DbgResponseTTLExpired    = "OCSP response cache expiry [%s] is before now [%s] with clockskew [%s]"
+	DbgResponseFutureDated   = "OCSP response ThisUpdate [%s] is before now [%s] with clockskew [%s]"
+	DbgCacheSaveTimerExpired = "OCSP peer cache save timer expired"
+	DbgCacheDirtySave        = "OCSP peer cache is dirty, saving"
+
+	// Returned to peer as TLS reject reason
+	MsgTLSClientRejectConnection = "client not OCSP valid"
+	MsgTLSServerRejectConnection = "server not OCSP valid"
+
+	// Expected runtime errors (direct logged)
+	ErrCAResponderCalloutFail  = "Attempt to obtain OCSP response from CA responder for [%s] failed: %s"
+	ErrNewCAResponseNotCurrent = "New OCSP CA response obtained for [%s] but not current"
+	ErrCAResponseParseFailed   = "Could not parse OCSP CA response for [%s]: %s"
+	ErrOCSPInvalidPeerLink     = "OCSP verify fail for [%s] with CA status [%s]"
+
+	// Policy override warnings (direct logged)
+	MsgAllowWhenCAUnreachableOccurred             = "Failed to obtain OCSP CA response for [%s] but AllowWhenCAUnreachable set; no cached revocation so allowing"
+	MsgAllowWhenCAUnreachableOccurredCachedRevoke = "Failed to obtain OCSP CA response for [%s] but AllowWhenCAUnreachable set; cached revocation exists so rejecting"
+	MsgAllowWarnOnlyOccurred                      = "OCSP verify fail for [%s] but WarnOnly is true so allowing"
+
+	// Info (direct logged)
+	MsgCacheOnline  = "OCSP peer cache online, type [%s]"
+	MsgCacheOffline = "OCSP peer cache offline, type [%s]"
+
+	// OCSP cert invalid reasons (debug and event reasons)
+	MsgFailedOCSPResponseFetch       = "Failed OCSP response fetch"
+	MsgOCSPResponseNotEffective      = "OCSP response not in effectivity window"
+	MsgFailedOCSPResponseParse       = "Failed OCSP response parse"
+	MsgOCSPResponseInvalidStatus     = "Invalid OCSP response status: %s"
+	MsgOCSPResponseDelegationInvalid = "Invalid OCSP response delegation: %s"
+	MsgCachedOCSPResponseInvalid     = "Invalid cached OCSP response for [%s] with fingerprint [%s]"
+)
diff --git a/server/certidp/ocsp_responder.go b/server/certidp/ocsp_responder.go
new file mode 100644
index 00000000..6e210f2b
--- /dev/null
+++ b/server/certidp/ocsp_responder.go
@@ -0,0 +1,83 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package certidp
+
+import (
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ocsp"
+)
+
+func FetchOCSPResponse(link *ChainLink, opts *OCSPPeerConfig, log *Log) ([]byte, error) {
+	if link == nil || link.Leaf == nil || link.Issuer == nil || opts == nil || log == nil {
+		return nil, fmt.Errorf(ErrInvalidChainlink)
+	}
+
+	timeout := time.Duration(opts.Timeout * float64(time.Second))
+	if timeout <= 0*time.Second {
+		timeout = DefaultOCSPResponderTimeout
+	}
+
+	getRequestBytes := func(u string, hc *http.Client) ([]byte, error) {
+		resp, err := hc.Get(u)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)
+		}
+		return io.ReadAll(resp.Body)
+	}
+
+	// Request documentation:
+	// https://tools.ietf.org/html/rfc6960#appendix-A.1
+
+	reqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	reqEnc := base64.StdEncoding.EncodeToString(reqDER)
+
+	responders := *link.OCSPWebEndpoints
+
+	if len(responders) == 0 {
+		return nil, fmt.Errorf(ErrNoAvailOCSPServers)
+	}
+
+	var raw []byte
+	hc := &http.Client{
+		Timeout: timeout,
+	}
+	for _, u := range responders {
+		url := u.String()
+		log.Debugf(DbgMakingCARequest, url)
+		url = strings.TrimSuffix(url, "/")
+		raw, err = getRequestBytes(fmt.Sprintf("%s/%s", url, reqEnc), hc)
+		if err == nil {
+			break
+		}
+	}
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedWithAllRequests, err)
+	}
+
+	return raw, nil
+}
diff --git a/server/client.go b/server/client.go
index b6f73442..a91058dc 100644
--- a/server/client.go
+++ b/server/client.go
@@ -204,6 +204,7 @@ const (
 	DuplicateServerName
 	MinimumVersionRequired
 	ClusterNamesIdentical
+	FailedOCSPPeerVerification
 )
 
 // Some flags passed to processMsgResults
diff --git a/server/events.go b/server/events.go
index e6b44d36..1b58d912 100644
--- a/server/events.go
+++ b/server/events.go
@@ -17,6 +17,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"crypto/sha256"
+	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -30,7 +31,9 @@ import (
 	"time"
 
 	"github.com/klauspost/compress/s2"
+
 	"github.com/nats-io/jwt/v2"
+	"github.com/nats-io/nats-server/v2/server/certidp"
 	"github.com/nats-io/nats-server/v2/server/pse"
 )
 
@@ -78,6 +81,9 @@ const (
 
 	accReqTokens   = 5
 	accReqAccIndex = 3
+
+	ocspPeerRejectEventSubj           = "$SYS.SERVER.%s.OCSP.PEER.CONN.REJECT"
+	ocspPeerChainlinkInvalidEventSubj = "$SYS.SERVER.%s.OCSP.PEER.LINK.INVALID"
 )
 
 // FIXME(dlc) - make configurable.
@@ -151,6 +157,34 @@ type DisconnectEventMsg struct {
 // DisconnectEventMsgType is the schema type for DisconnectEventMsg
 const DisconnectEventMsgType = "io.nats.server.advisory.v1.client_disconnect"
 
+// OCSPPeerRejectEventMsg is sent when a peer TLS handshake is ultimately rejected due to OCSP invalidation.
+// A "peer" can be an inbound client connection or a leaf connection to a remote server. Peer in event payload
+// is always the peer's (TLS) leaf cert, which may or may be the invalid cert (See also OCSPPeerChainlinkInvalidEventMsg)
+type OCSPPeerRejectEventMsg struct {
+	TypedEvent
+	Kind   string           `json:"kind"`
+	Peer   certidp.CertInfo `json:"peer"`
+	Server ServerInfo       `json:"server"`
+	Reason string           `json:"reason"`
+}
+
+// OCSPPeerRejectEventMsgType is the schema type for OCSPPeerRejectEventMsg
+const OCSPPeerRejectEventMsgType = "io.nats.server.advisory.v1.ocsp_peer_reject"
+
+// OCSPPeerChainlinkInvalidEventMsg is sent when a certificate (link) in a valid TLS chain is found to be OCSP invalid
+// during a peer TLS handshake. A "peer" can be an inbound client connection or a leaf connection to a remote server.
+// Peer and Link may be the same if the invalid cert was the peer's leaf cert
+type OCSPPeerChainlinkInvalidEventMsg struct {
+	TypedEvent
+	Link   certidp.CertInfo `json:"link"`
+	Peer   certidp.CertInfo `json:"peer"`
+	Server ServerInfo       `json:"server"`
+	Reason string           `json:"reason"`
+}
+
+// OCSPPeerChainlinkInvalidEventMsgType is the schema type for OCSPPeerChainlinkInvalidEventMsg
+const OCSPPeerChainlinkInvalidEventMsgType = "io.nats.server.advisory.v1.ocsp_peer_link_invalid"
+
 // AccountNumConns is an event that will be sent from a server that is tracking
 // a given account when the number of connections changes. It will also HB
 // updates in the absence of any changes.
@@ -2468,3 +2502,74 @@ func (s *Server) wrapChk(f func()) func() {
 		s.mu.Unlock()
 	}
 }
+
+// sendOCSPPeerRejectEvent sends a system level event to system account when a peer connection is
+// rejected due to OCSP invalid status of its trust chain(s).
+func (s *Server) sendOCSPPeerRejectEvent(kind string, peer *x509.Certificate, reason string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.eventsEnabled() {
+		return
+	}
+	if peer == nil {
+		s.Errorf(certidp.ErrPeerEmptyNoEvent)
+		return
+	}
+	eid := s.nextEventID()
+	now := time.Now().UTC()
+	m := OCSPPeerRejectEventMsg{
+		TypedEvent: TypedEvent{
+			Type: OCSPPeerRejectEventMsgType,
+			ID:   eid,
+			Time: now,
+		},
+		Kind: kind,
+		Peer: certidp.CertInfo{
+			Subject:     certidp.GetSubjectDNForm(peer),
+			Issuer:      certidp.GetIssuerDNForm(peer),
+			Fingerprint: certidp.GenerateFingerprint(peer),
+			Raw:         peer.Raw,
+		},
+		Reason: reason,
+	}
+	subj := fmt.Sprintf(ocspPeerRejectEventSubj, s.info.ID)
+	s.sendInternalMsg(subj, _EMPTY_, &m.Server, &m)
+}
+
+// sendOCSPPeerChainlinkInvalidEvent sends a system level event to system account when a link in a peer's trust chain
+// is OCSP invalid.
+func (s *Server) sendOCSPPeerChainlinkInvalidEvent(peer *x509.Certificate, link *x509.Certificate, reason string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.eventsEnabled() {
+		return
+	}
+	if peer == nil || link == nil {
+		s.Errorf(certidp.ErrPeerEmptyNoEvent)
+		return
+	}
+	eid := s.nextEventID()
+	now := time.Now().UTC()
+	m := OCSPPeerChainlinkInvalidEventMsg{
+		TypedEvent: TypedEvent{
+			Type: OCSPPeerChainlinkInvalidEventMsgType,
+			ID:   eid,
+			Time: now,
+		},
+		Link: certidp.CertInfo{
+			Subject:     certidp.GetSubjectDNForm(link),
+			Issuer:      certidp.GetIssuerDNForm(link),
+			Fingerprint: certidp.GenerateFingerprint(link),
+			Raw:         link.Raw,
+		},
+		Peer: certidp.CertInfo{
+			Subject:     certidp.GetSubjectDNForm(peer),
+			Issuer:      certidp.GetIssuerDNForm(peer),
+			Fingerprint: certidp.GenerateFingerprint(peer),
+			Raw:         peer.Raw,
+		},
+		Reason: reason,
+	}
+	subj := fmt.Sprintf(ocspPeerChainlinkInvalidEventSubj, s.info.ID)
+	s.sendInternalMsg(subj, _EMPTY_, &m.Server, &m)
+}
diff --git a/server/monitor.go b/server/monitor.go
index 654bb916..2c01c4e3 100644
--- a/server/monitor.go
+++ b/server/monitor.go
@@ -1154,6 +1154,7 @@ type Varz struct {
 	AuthRequired          bool                  `json:"auth_required,omitempty"`
 	TLSRequired           bool                  `json:"tls_required,omitempty"`
 	TLSVerify             bool                  `json:"tls_verify,omitempty"`
+	TLSOCSPPeerVerify     bool                  `json:"tls_ocsp_peer_verify,omitempty"`
 	IP                    string                `json:"ip,omitempty"`
 	ClientConnectURLs     []string              `json:"connect_urls,omitempty"`
 	WSConnectURLs         []string              `json:"ws_connect_urls,omitempty"`
@@ -1202,6 +1203,7 @@ type Varz struct {
 	TrustedOperatorsClaim []*jwt.OperatorClaims `json:"trusted_operators_claim,omitempty"`
 	SystemAccount         string                `json:"system_account,omitempty"`
 	PinnedAccountFail     uint64                `json:"pinned_account_fails,omitempty"`
+	OCSPResponseCache     OCSPResponseCacheVarz `json:"ocsp_peer_cache,omitempty"`
 }
 
 // JetStreamVarz contains basic runtime information about jetstream
@@ -1247,13 +1249,14 @@ type RemoteGatewayOptsVarz struct {
 
 // LeafNodeOptsVarz contains monitoring leaf node information
 type LeafNodeOptsVarz struct {
-	Host        string               `json:"host,omitempty"`
-	Port        int                  `json:"port,omitempty"`
-	AuthTimeout float64              `json:"auth_timeout,omitempty"`
-	TLSTimeout  float64              `json:"tls_timeout,omitempty"`
-	TLSRequired bool                 `json:"tls_required,omitempty"`
-	TLSVerify   bool                 `json:"tls_verify,omitempty"`
-	Remotes     []RemoteLeafOptsVarz `json:"remotes,omitempty"`
+	Host              string               `json:"host,omitempty"`
+	Port              int                  `json:"port,omitempty"`
+	AuthTimeout       float64              `json:"auth_timeout,omitempty"`
+	TLSTimeout        float64              `json:"tls_timeout,omitempty"`
+	TLSRequired       bool                 `json:"tls_required,omitempty"`
+	TLSVerify         bool                 `json:"tls_verify,omitempty"`
+	Remotes           []RemoteLeafOptsVarz `json:"remotes,omitempty"`
+	TLSOCSPPeerVerify bool                 `json:"tls_ocsp_peer_verify,omitempty"`
 }
 
 // DenyRules Contains lists of subjects not allowed to be imported/exported
@@ -1264,41 +1267,55 @@ type DenyRules struct {
 
 // RemoteLeafOptsVarz contains monitoring remote leaf node information
 type RemoteLeafOptsVarz struct {
-	LocalAccount string     `json:"local_account,omitempty"`
-	TLSTimeout   float64    `json:"tls_timeout,omitempty"`
-	URLs         []string   `json:"urls,omitempty"`
-	Deny         *DenyRules `json:"deny,omitempty"`
+	LocalAccount      string     `json:"local_account,omitempty"`
+	TLSTimeout        float64    `json:"tls_timeout,omitempty"`
+	URLs              []string   `json:"urls,omitempty"`
+	Deny              *DenyRules `json:"deny,omitempty"`
+	TLSOCSPPeerVerify bool       `json:"tls_ocsp_peer_verify,omitempty"`
 }
 
 // MQTTOptsVarz contains monitoring MQTT information
 type MQTTOptsVarz struct {
-	Host           string        `json:"host,omitempty"`
-	Port           int           `json:"port,omitempty"`
-	NoAuthUser     string        `json:"no_auth_user,omitempty"`
-	AuthTimeout    float64       `json:"auth_timeout,omitempty"`
-	TLSMap         bool          `json:"tls_map,omitempty"`
-	TLSTimeout     float64       `json:"tls_timeout,omitempty"`
-	TLSPinnedCerts []string      `json:"tls_pinned_certs,omitempty"`
-	JsDomain       string        `json:"js_domain,omitempty"`
-	AckWait        time.Duration `json:"ack_wait,omitempty"`
-	MaxAckPending  uint16        `json:"max_ack_pending,omitempty"`
+	Host              string        `json:"host,omitempty"`
+	Port              int           `json:"port,omitempty"`
+	NoAuthUser        string        `json:"no_auth_user,omitempty"`
+	AuthTimeout       float64       `json:"auth_timeout,omitempty"`
+	TLSMap            bool          `json:"tls_map,omitempty"`
+	TLSTimeout        float64       `json:"tls_timeout,omitempty"`
+	TLSPinnedCerts    []string      `json:"tls_pinned_certs,omitempty"`
+	JsDomain          string        `json:"js_domain,omitempty"`
+	AckWait           time.Duration `json:"ack_wait,omitempty"`
+	MaxAckPending     uint16        `json:"max_ack_pending,omitempty"`
+	TLSOCSPPeerVerify bool          `json:"tls_ocsp_peer_verify,omitempty"`
 }
 
 // WebsocketOptsVarz contains monitoring websocket information
 type WebsocketOptsVarz struct {
-	Host             string        `json:"host,omitempty"`
-	Port             int           `json:"port,omitempty"`
-	Advertise        string        `json:"advertise,omitempty"`
-	NoAuthUser       string        `json:"no_auth_user,omitempty"`
-	JWTCookie        string        `json:"jwt_cookie,omitempty"`
-	HandshakeTimeout time.Duration `json:"handshake_timeout,omitempty"`
-	AuthTimeout      float64       `json:"auth_timeout,omitempty"`
-	NoTLS            bool          `json:"no_tls,omitempty"`
-	TLSMap           bool          `json:"tls_map,omitempty"`
-	TLSPinnedCerts   []string      `json:"tls_pinned_certs,omitempty"`
-	SameOrigin       bool          `json:"same_origin,omitempty"`
-	AllowedOrigins   []string      `json:"allowed_origins,omitempty"`
-	Compression      bool          `json:"compression,omitempty"`
+	Host              string        `json:"host,omitempty"`
+	Port              int           `json:"port,omitempty"`
+	Advertise         string        `json:"advertise,omitempty"`
+	NoAuthUser        string        `json:"no_auth_user,omitempty"`
+	JWTCookie         string        `json:"jwt_cookie,omitempty"`
+	HandshakeTimeout  time.Duration `json:"handshake_timeout,omitempty"`
+	AuthTimeout       float64       `json:"auth_timeout,omitempty"`
+	NoTLS             bool          `json:"no_tls,omitempty"`
+	TLSMap            bool          `json:"tls_map,omitempty"`
+	TLSPinnedCerts    []string      `json:"tls_pinned_certs,omitempty"`
+	SameOrigin        bool          `json:"same_origin,omitempty"`
+	AllowedOrigins    []string      `json:"allowed_origins,omitempty"`
+	Compression       bool          `json:"compression,omitempty"`
+	TLSOCSPPeerVerify bool          `json:"tls_ocsp_peer_verify,omitempty"`
+}
+
+// OCSPResponseCacheVarz contains OCSP response cache information
+type OCSPResponseCacheVarz struct {
+	Type      string `json:"cache_type,omitempty"`
+	Hits      int64  `json:"cache_hits,omitempty"`
+	Misses    int64  `json:"cache_misses,omitempty"`
+	Responses int64  `json:"cached_responses,omitempty"`
+	Revokes   int64  `json:"cached_revoked_responses,omitempty"`
+	Goods     int64  `json:"cached_good_responses,omitempty"`
+	Unknowns  int64  `json:"cached_unknown_responses,omitempty"`
 }
 
 // VarzOptions are the options passed to Varz().
@@ -1452,6 +1469,9 @@ func (s *Server) createVarz(pcpu float64, rss int64) *Varz {
 	gatewayTlsReq := gw.TLSConfig != nil
 	leafTlsReq := ln.TLSConfig != nil
 	leafTlsVerify := leafTlsReq && ln.TLSConfig.ClientAuth == tls.RequireAndVerifyClientCert
+	leafTlsOCSPPeerVerify := s.ocspPeerVerify && leafTlsReq && ln.tlsConfigOpts.OCSPPeerConfig != nil && ln.tlsConfigOpts.OCSPPeerConfig.Verify
+	mqttTlsOCSPPeerVerify := s.ocspPeerVerify && mqtt.TLSConfig != nil && mqtt.tlsConfigOpts.OCSPPeerConfig != nil && mqtt.tlsConfigOpts.OCSPPeerConfig.Verify
+	wsTlsOCSPPeerVerify := s.ocspPeerVerify && ws.TLSConfig != nil && ws.tlsConfigOpts.OCSPPeerConfig != nil && ws.tlsConfigOpts.OCSPPeerConfig.Verify
 	varz := &Varz{
 		ID:           info.ID,
 		Version:      info.Version,
@@ -1489,38 +1509,41 @@ func (s *Server) createVarz(pcpu float64, rss int64) *Varz {
 			RejectUnknown:  gw.RejectUnknown,
 		},
 		LeafNode: LeafNodeOptsVarz{
-			Host:        ln.Host,
-			Port:        ln.Port,
-			AuthTimeout: ln.AuthTimeout,
-			TLSTimeout:  ln.TLSTimeout,
-			TLSRequired: leafTlsReq,
-			TLSVerify:   leafTlsVerify,
-			Remotes:     []RemoteLeafOptsVarz{},
+			Host:              ln.Host,
+			Port:              ln.Port,
+			AuthTimeout:       ln.AuthTimeout,
+			TLSTimeout:        ln.TLSTimeout,
+			TLSRequired:       leafTlsReq,
+			TLSVerify:         leafTlsVerify,
+			TLSOCSPPeerVerify: leafTlsOCSPPeerVerify,
+			Remotes:           []RemoteLeafOptsVarz{},
 		},
 		MQTT: MQTTOptsVarz{
-			Host:          mqtt.Host,
-			Port:          mqtt.Port,
-			NoAuthUser:    mqtt.NoAuthUser,
-			AuthTimeout:   mqtt.AuthTimeout,
-			TLSMap:        mqtt.TLSMap,
-			TLSTimeout:    mqtt.TLSTimeout,
-			JsDomain:      mqtt.JsDomain,
-			AckWait:       mqtt.AckWait,
-			MaxAckPending: mqtt.MaxAckPending,
+			Host:              mqtt.Host,
+			Port:              mqtt.Port,
+			NoAuthUser:        mqtt.NoAuthUser,
+			AuthTimeout:       mqtt.AuthTimeout,
+			TLSMap:            mqtt.TLSMap,
+			TLSTimeout:        mqtt.TLSTimeout,
+			JsDomain:          mqtt.JsDomain,
+			AckWait:           mqtt.AckWait,
+			MaxAckPending:     mqtt.MaxAckPending,
+			TLSOCSPPeerVerify: mqttTlsOCSPPeerVerify,
 		},
 		Websocket: WebsocketOptsVarz{
-			Host:             ws.Host,
-			Port:             ws.Port,
-			Advertise:        ws.Advertise,
-			NoAuthUser:       ws.NoAuthUser,
-			JWTCookie:        ws.JWTCookie,
-			AuthTimeout:      ws.AuthTimeout,
-			NoTLS:            ws.NoTLS,
-			TLSMap:           ws.TLSMap,
-			SameOrigin:       ws.SameOrigin,
-			AllowedOrigins:   copyStrings(ws.AllowedOrigins),
-			Compression:      ws.Compression,
-			HandshakeTimeout: ws.HandshakeTimeout,
+			Host:              ws.Host,
+			Port:              ws.Port,
+			Advertise:         ws.Advertise,
+			NoAuthUser:        ws.NoAuthUser,
+			JWTCookie:         ws.JWTCookie,
+			AuthTimeout:       ws.AuthTimeout,
+			NoTLS:             ws.NoTLS,
+			TLSMap:            ws.TLSMap,
+			SameOrigin:        ws.SameOrigin,
+			AllowedOrigins:    copyStrings(ws.AllowedOrigins),
+			Compression:       ws.Compression,
+			HandshakeTimeout:  ws.HandshakeTimeout,
+			TLSOCSPPeerVerify: wsTlsOCSPPeerVerify,
 		},
 		Start:                 s.start.UTC(),
 		MaxSubs:               opts.MaxSubs,
@@ -1553,11 +1576,14 @@ func (s *Server) createVarz(pcpu float64, rss int64) *Varz {
 					Exports: r.DenyExports,
 				}
 			}
+			remoteTlsOCSPPeerVerify := s.ocspPeerVerify && r.tlsConfigOpts != nil && r.tlsConfigOpts.OCSPPeerConfig != nil && r.tlsConfigOpts.OCSPPeerConfig.Verify
+
 			rlna[i] = RemoteLeafOptsVarz{
-				LocalAccount: r.LocalAccount,
-				URLs:         urlsToStrings(r.URLs),
-				TLSTimeout:   r.TLSTimeout,
-				Deny:         deny,
+				LocalAccount:      r.LocalAccount,
+				URLs:              urlsToStrings(r.URLs),
+				TLSTimeout:        r.TLSTimeout,
+				Deny:              deny,
+				TLSOCSPPeerVerify: remoteTlsOCSPPeerVerify,
 			}
 		}
 		varz.LeafNode.Remotes = rlna
@@ -1611,6 +1637,8 @@ func (s *Server) updateVarzConfigReloadableFields(v *Varz) {
 	}
 	v.MQTT.TLSPinnedCerts = getPinnedCertsAsSlice(opts.MQTT.TLSPinnedCerts)
 	v.Websocket.TLSPinnedCerts = getPinnedCertsAsSlice(opts.Websocket.TLSPinnedCerts)
+
+	v.TLSOCSPPeerVerify = s.ocspPeerVerify && v.TLSRequired && s.opts.tlsConfigOpts != nil && s.opts.tlsConfigOpts.OCSPPeerConfig != nil && s.opts.tlsConfigOpts.OCSPPeerConfig.Verify
 }
 
 func getPinnedCertsAsSlice(certs PinnedCertSet) []string {
@@ -1702,6 +1730,21 @@ func (s *Server) updateVarzRuntimeFields(v *Varz, forceUpdate bool, pcpu float64
 		}
 	}
 	gw.RUnlock()
+
+	if s.ocsprc != nil && s.ocsprc.Type() != "none" {
+		stats := s.ocsprc.Stats()
+		if stats != nil {
+			v.OCSPResponseCache = OCSPResponseCacheVarz{
+				s.ocsprc.Type(),
+				stats.Hits,
+				stats.Misses,
+				stats.Responses,
+				stats.Revokes,
+				stats.Goods,
+				stats.Unknowns,
+			}
+		}
+	}
 }
 
 // HandleVarz will process HTTP requests for server information.
@@ -2344,6 +2387,8 @@ func (reason ClosedState) String() string {
 		return "Minimum Version Required"
 	case ClusterNamesIdentical:
 		return "Cluster Names Identical"
+	case FailedOCSPPeerVerification:
+		return "Failed OCSP Peer Verification"
 	}
 
 	return "Unknown State"
diff --git a/server/monitor_test.go b/server/monitor_test.go
index b7b02b7a..a0caa579 100644
--- a/server/monitor_test.go
+++ b/server/monitor_test.go
@@ -2966,9 +2966,10 @@ func TestMonitorLeafNode(t *testing.T) {
 		opts.LeafNode.TLSConfig != nil,
 		[]RemoteLeafOptsVarz{
 			{
-				"acc", 1, []string{"localhost:1234"}, nil,
+				"acc", 1, []string{"localhost:1234"}, nil, false,
 			},
 		},
+		false,
 	}
 
 	varzURL := fmt.Sprintf("http://127.0.0.1:%d/varz", s.MonitorAddr().Port)
@@ -2985,7 +2986,7 @@ func TestMonitorLeafNode(t *testing.T) {
 
 		// Having this here to make sure that if fields are added in ClusterOptsVarz,
 		// we make sure to update this test (compiler will report an error if we don't)
-		_ = LeafNodeOptsVarz{"", 0, 0, 0, false, false, []RemoteLeafOptsVarz{{"", 0, nil, nil}}}
+		_ = LeafNodeOptsVarz{"", 0, 0, 0, false, false, []RemoteLeafOptsVarz{{"", 0, nil, nil, false}}, false}
 
 		// Alter the fields to make sure that we have a proper deep copy
 		// of what may be stored in the server. Anything we change here
diff --git a/server/ocsp.go b/server/ocsp.go
index 9c5dcb93..26a665b2 100644
--- a/server/ocsp.go
+++ b/server/ocsp.go
@@ -520,10 +520,11 @@ func (s *Server) setupOCSPStapleStoreDir() error {
 }
 
 type tlsConfigKind struct {
-	tlsConfig *tls.Config
-	tlsOpts   *TLSConfigOpts
-	kind      string
-	apply     func(*tls.Config)
+	tlsConfig   *tls.Config
+	tlsOpts     *TLSConfigOpts
+	kind        string
+	isLeafSpoke bool
+	apply       func(*tls.Config)
 }
 
 func (s *Server) configureOCSP() []*tlsConfigKind {
@@ -541,6 +542,26 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
 		}
 		configs = append(configs, o)
 	}
+	if config := sopts.Websocket.TLSConfig; config != nil {
+		opts := sopts.Websocket.tlsConfigOpts
+		o := &tlsConfigKind{
+			kind:      kindStringMap[CLIENT],
+			tlsConfig: config,
+			tlsOpts:   opts,
+			apply:     func(tc *tls.Config) { sopts.Websocket.TLSConfig = tc },
+		}
+		configs = append(configs, o)
+	}
+	if config := sopts.MQTT.TLSConfig; config != nil {
+		opts := sopts.tlsConfigOpts
+		o := &tlsConfigKind{
+			kind:      kindStringMap[CLIENT],
+			tlsConfig: config,
+			tlsOpts:   opts,
+			apply:     func(tc *tls.Config) { sopts.MQTT.TLSConfig = tc },
+		}
+		configs = append(configs, o)
+	}
 	if config := sopts.Cluster.TLSConfig; config != nil {
 		opts := sopts.Cluster.tlsConfigOpts
 		o := &tlsConfigKind{
@@ -557,16 +578,7 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
 			kind:      kindStringMap[LEAF],
 			tlsConfig: config,
 			tlsOpts:   opts,
-			apply: func(tc *tls.Config) {
-				// RequireAndVerifyClientCert is used to tell a client that it
-				// should send the client cert to the server.
-				if opts.Verify {
-					tc.ClientAuth = tls.RequireAndVerifyClientCert
-				}
-				// We're a leaf hub server, so we must not set this.
-				tc.GetClientCertificate = nil
-				sopts.LeafNode.TLSConfig = tc
-			},
+			apply:     func(tc *tls.Config) { sopts.LeafNode.TLSConfig = tc },
 		}
 		configs = append(configs, o)
 	}
@@ -576,14 +588,11 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
 			// in the apply func callback below.
 			r, opts := remote, remote.tlsConfigOpts
 			o := &tlsConfigKind{
-				kind:      kindStringMap[LEAF],
-				tlsConfig: config,
-				tlsOpts:   opts,
-				apply: func(tc *tls.Config) {
-					// We're a leaf client, so we must not set this.
-					tc.GetCertificate = nil
-					r.TLSConfig = tc
-				},
+				kind:        kindStringMap[LEAF],
+				tlsConfig:   config,
+				tlsOpts:     opts,
+				isLeafSpoke: true,
+				apply:       func(tc *tls.Config) { r.TLSConfig = tc },
 			}
 			configs = append(configs, o)
 		}
@@ -605,9 +614,7 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
 				kind:      kindStringMap[GATEWAY],
 				tlsConfig: config,
 				tlsOpts:   opts,
-				apply: func(tc *tls.Config) {
-					gw.TLSConfig = tc
-				},
+				apply:     func(tc *tls.Config) { gw.TLSConfig = tc },
 			}
 			configs = append(configs, o)
 		}
@@ -619,16 +626,33 @@ func (s *Server) enableOCSP() error {
 	configs := s.configureOCSP()
 
 	for _, config := range configs {
-		tc, mon, err := s.NewOCSPMonitor(config)
-		if err != nil {
-			return err
-		}
-		// Check if an OCSP stapling monitor is required for this certificate.
-		if mon != nil {
-			s.ocsps = append(s.ocsps, mon)
 
-			// Override the TLS config with one that follows OCSP.
-			config.apply(tc)
+		// We do not staple Leaf Hub and Leaf Spokes, use ocsp_peer
+		if config.kind != kindStringMap[LEAF] {
+			// OCSP Stapling feature, will also enable tls server peer check for gateway and route peers
+			tc, mon, err := s.NewOCSPMonitor(config)
+			if err != nil {
+				return err
+			}
+			// Check if an OCSP stapling monitor is required for this certificate.
+			if mon != nil {
+				s.ocsps = append(s.ocsps, mon)
+
+				// Override the TLS config with one that follows OCSP stapling
+				config.apply(tc)
+			}
+		}
+
+		// OCSP peer check (client mTLS, leaf mTLS, leaf remote TLS)
+		if config.kind == kindStringMap[CLIENT] || config.kind == kindStringMap[LEAF] {
+			tc, plugged, err := s.plugTLSOCSPPeer(config)
+			if err != nil {
+				return err
+			}
+			if plugged && tc != nil {
+				s.ocspPeerVerify = true
+				config.apply(tc)
+			}
 		}
 	}
 
@@ -670,17 +694,39 @@ func (s *Server) reloadOCSP() error {
 
 	// Restart the monitors under the new configuration.
 	ocspm := make([]*OCSPMonitor, 0)
-	for _, config := range configs {
-		tc, mon, err := s.NewOCSPMonitor(config)
-		if err != nil {
-			return err
-		}
-		// Check if an OCSP stapling monitor is required for this certificate.
-		if mon != nil {
-			ocspm = append(ocspm, mon)
 
-			// Apply latest TLS configuration.
-			config.apply(tc)
+	// Reset server's ocspPeerVerify flag to re-detect at least one plugged OCSP peer
+	s.mu.Lock()
+	s.ocspPeerVerify = false
+	s.mu.Unlock()
+	s.stopOCSPResponseCache()
+
+	for _, config := range configs {
+		// We do not staple Leaf Hub and Leaf Spokes, use ocsp_peer
+		if config.kind != kindStringMap[LEAF] {
+			tc, mon, err := s.NewOCSPMonitor(config)
+			if err != nil {
+				return err
+			}
+			// Check if an OCSP stapling monitor is required for this certificate.
+			if mon != nil {
+				ocspm = append(ocspm, mon)
+
+				// Apply latest TLS configuration.
+				config.apply(tc)
+			}
+		}
+
+		// OCSP peer check (client mTLS, leaf mTLS, leaf remote TLS)
+		if config.kind == kindStringMap[CLIENT] || config.kind == kindStringMap[LEAF] {
+			tc, plugged, err := s.plugTLSOCSPPeer(config)
+			if err != nil {
+				return err
+			}
+			if plugged && tc != nil {
+				s.ocspPeerVerify = true
+				config.apply(tc)
+			}
 		}
 	}
 
@@ -692,6 +738,11 @@ func (s *Server) reloadOCSP() error {
 	// Dispatch all goroutines once again.
 	s.startOCSPMonitoring()
 
+	// Init and restart OCSP responder cache
+	s.stopOCSPResponseCache()
+	s.initOCSPResponseCache()
+	s.startOCSPResponseCache()
+
 	return nil
 }
 
diff --git a/server/ocsp_peer.go b/server/ocsp_peer.go
new file mode 100644
index 00000000..0ddcc0c8
--- /dev/null
+++ b/server/ocsp_peer.go
@@ -0,0 +1,405 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ocsp"
+
+	"github.com/nats-io/nats-server/v2/server/certidp"
+)
+
+func parseOCSPPeer(v interface{}) (pcfg *certidp.OCSPPeerConfig, retError error) {
+	var lt token
+	defer convertPanicToError(&lt, &retError)
+	tk, v := unwrapValue(v, &lt)
+	cm, ok := v.(map[string]interface{})
+	if !ok {
+		return nil, &configErr{tk, fmt.Sprintf(certidp.ErrIllegalPeerOptsConfig, v)}
+	}
+	pcfg = certidp.NewOCSPPeerConfig()
+	retError = nil
+	for mk, mv := range cm {
+		tk, mv = unwrapValue(mv, &lt)
+		switch strings.ToLower(mk) {
+		case "verify":
+			verify, ok := mv.(bool)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}
+			}
+			pcfg.Verify = verify
+		case "allowed_clockskew":
+			at := float64(0)
+			switch mv := mv.(type) {
+			case int64:
+				at = float64(mv)
+			case float64:
+				at = mv
+			case string:
+				d, err := time.ParseDuration(mv)
+				if err != nil {
+					return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, "unexpected type")}
+				}
+				at = d.Seconds()
+			default:
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, "unexpected type")}
+			}
+			if at >= 0 {
+				pcfg.ClockSkew = at
+			}
+		case "ca_timeout":
+			at := float64(0)
+			switch mv := mv.(type) {
+			case int64:
+				at = float64(mv)
+			case float64:
+				at = mv
+			case string:
+				d, err := time.ParseDuration(mv)
+				if err != nil {
+					return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, err)}
+				}
+				at = d.Seconds()
+			default:
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, "unexpected type")}
+			}
+			if at >= 0 {
+				pcfg.Timeout = at
+			}
+		case "cache_ttl_when_next_update_unset":
+			at := float64(0)
+			switch mv := mv.(type) {
+			case int64:
+				at = float64(mv)
+			case float64:
+				at = mv
+			case string:
+				d, err := time.ParseDuration(mv)
+				if err != nil {
+					return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, err)}
+				}
+				at = d.Seconds()
+			default:
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, "unexpected type")}
+			}
+			if at >= 0 {
+				pcfg.TTLUnsetNextUpdate = at
+			}
+		case "warn_only":
+			warnOnly, ok := mv.(bool)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}
+			}
+			pcfg.WarnOnly = warnOnly
+		case "unknown_is_good":
+			unknownIsGood, ok := mv.(bool)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}
+			}
+			pcfg.UnknownIsGood = unknownIsGood
+		case "allow_when_ca_unreachable":
+			allowWhenCAUnreachable, ok := mv.(bool)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}
+			}
+			pcfg.AllowWhenCAUnreachable = allowWhenCAUnreachable
+		default:
+			return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}
+		}
+	}
+	return pcfg, nil
+}
+
+func peerFromVerifiedChains(chains [][]*x509.Certificate) *x509.Certificate {
+	if len(chains) == 0 || len(chains[0]) == 0 {
+		return nil
+	}
+	return chains[0][0]
+}
+
+// plugTLSOCSPPeer will plug the TLS handshake lifecycle for client mTLS connections and Leaf connections
+func (s *Server) plugTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {
+	if config == nil || config.tlsConfig == nil {
+		return nil, false, errors.New(certidp.ErrUnableToPlugTLSEmptyConfig)
+	}
+	s.Debugf(certidp.DbgPlugTLSForKind, config.kind)
+	kind := config.kind
+	isSpoke := config.isLeafSpoke
+	tcOpts := config.tlsOpts
+	if tcOpts == nil || tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {
+		return nil, false, nil
+	}
+	// peer is a tls client
+	if kind == kindStringMap[CLIENT] || (kind == kindStringMap[LEAF] && !isSpoke) {
+		if !tcOpts.Verify {
+			return nil, false, errors.New(certidp.ErrMTLSRequired)
+		}
+		return s.plugClientTLSOCSPPeer(config)
+	}
+	// peer is a tls server
+	if kind == kindStringMap[LEAF] && isSpoke {
+		return s.plugServerTLSOCSPPeer(config)
+	}
+	return nil, false, nil
+}
+
+func (s *Server) plugClientTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {
+	if config == nil || config.tlsConfig == nil || config.tlsOpts == nil {
+		return nil, false, errors.New(certidp.ErrUnableToPlugTLSClient)
+	}
+	tc := config.tlsConfig
+	tcOpts := config.tlsOpts
+	kind := config.kind
+	if tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {
+		return tc, false, nil
+	}
+	tc.VerifyConnection = func(cs tls.ConnectionState) error {
+		if !s.tlsClientOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {
+			s.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSClientRejectConnection)
+			return errors.New(certidp.MsgTLSClientRejectConnection)
+		}
+		return nil
+	}
+	return tc, true, nil
+}
+
+func (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {
+	if config == nil || config.tlsConfig == nil || config.tlsOpts == nil {
+		return nil, false, errors.New(certidp.ErrUnableToPlugTLSServer)
+	}
+	tc := config.tlsConfig
+	tcOpts := config.tlsOpts
+	kind := config.kind
+	if tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {
+		return tc, false, nil
+	}
+	tc.VerifyConnection = func(cs tls.ConnectionState) error {
+		if !s.tlsServerOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {
+			s.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSServerRejectConnection)
+			return errors.New(certidp.MsgTLSServerRejectConnection)
+		}
+		return nil
+	}
+	return tc, true, nil
+}
+
+// tlsServerOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP
+// eligibility. A verified chain is considered OCSP Valid if either none of the links are
+// OCSP eligible, or current "good" responses from the CA can be obtained for each eligible link.
+// Upon first OCSP Valid chain found, the Server is deemed OCSP Valid. If none of the chains are
+// OCSP Valid, the Server is deemed OCSP Invalid. A verified self-signed certificate (chain length 1)
+// is also considered OCSP Valid.
+func (s *Server) tlsServerOCSPValid(chains [][]*x509.Certificate, opts *certidp.OCSPPeerConfig) bool {
+	s.Debugf(certidp.DbgNumServerChains, len(chains))
+	return s.peerOCSPValid(chains, opts)
+}
+
+// tlsClientOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP
+// eligibility. A verified chain is considered OCSP Valid if either none of the links are
+// OCSP eligible, or current "good" responses from the CA can be obtained for each eligible link.
+// Upon first OCSP Valid chain found, the Client is deemed OCSP Valid. If none of the chains are
+// OCSP Valid, the Client is deemed OCSP Invalid. A verified self-signed certificate (chain length 1)
+// is also considered OCSP Valid.
+func (s *Server) tlsClientOCSPValid(chains [][]*x509.Certificate, opts *certidp.OCSPPeerConfig) bool {
+	s.Debugf(certidp.DbgNumClientChains, len(chains))
+	return s.peerOCSPValid(chains, opts)
+}
+
+func (s *Server) peerOCSPValid(chains [][]*x509.Certificate, opts *certidp.OCSPPeerConfig) bool {
+	peer := peerFromVerifiedChains(chains)
+	if peer == nil {
+		s.Errorf(certidp.ErrPeerEmptyAutoReject)
+		return false
+	}
+	for ci, chain := range chains {
+		s.Debugf(certidp.DbgLinksInChain, ci, len(chain))
+		// Self-signed certificate is Client OCSP Valid (no CA)
+		if len(chain) == 1 {
+			s.Debugf(certidp.DbgSelfSignedValid, ci)
+			return true
+		}
+		// Check if any of the links in the chain are OCSP eligible
+		chainEligible := false
+		var eligibleLinks []*certidp.ChainLink
+		// Iterate over links skipping the root cert which is not OCSP eligible (self == issuer)
+		for linkPos := 0; linkPos < len(chain)-1; linkPos++ {
+			cert := chain[linkPos]
+			link := &certidp.ChainLink{
+				Leaf: cert,
+			}
+			if certidp.CertOCSPEligible(link) {
+				chainEligible = true
+				issuerCert := certidp.GetLeafIssuerCert(chain, linkPos)
+				if issuerCert == nil {
+					// unexpected chain condition, reject Client as OCSP Invalid
+					return false
+				}
+				link.Issuer = issuerCert
+				eligibleLinks = append(eligibleLinks, link)
+			}
+		}
+		// A trust-store verified chain that is not OCSP eligible is always OCSP Valid
+		if !chainEligible {
+			s.Debugf(certidp.DbgValidNonOCSPChain, ci)
+			return true
+		}
+		s.Debugf(certidp.DbgChainIsOCSPEligible, ci, len(eligibleLinks))
+		// Chain has at least one OCSP eligible link, so check each eligible link;
+		// any link with a !good OCSP response chain OCSP Invalid
+		chainValid := true
+		for _, link := range eligibleLinks {
+			// if option selected, good could reflect either ocsp.Good or ocsp.Unknown
+			if badReason, good := s.certOCSPGood(link, opts); !good {
+				s.Debugf(badReason)
+				s.sendOCSPPeerChainlinkInvalidEvent(peer, link.Leaf, badReason)
+				chainValid = false
+				break
+			}
+		}
+		if chainValid {
+			s.Debugf(certidp.DbgChainIsOCSPValid, ci)
+			return true
+		}
+	}
+	// If we are here, all chains had OCSP eligible links, but none of the chains achieved OCSP valid
+	s.Debugf(certidp.DbgNoOCSPValidChains)
+	return false
+}
+
+func (s *Server) certOCSPGood(link *certidp.ChainLink, opts *certidp.OCSPPeerConfig) (string, bool) {
+	if link == nil || link.Leaf == nil || link.Issuer == nil || link.OCSPWebEndpoints == nil || len(*link.OCSPWebEndpoints) < 1 {
+		return "Empty chainlink found", false
+	}
+	var err error
+	sLogs := &certidp.Log{
+		Debugf:  s.Debugf,
+		Noticef: s.Noticef,
+		Warnf:   s.Warnf,
+		Errorf:  s.Errorf,
+		Tracef:  s.Tracef,
+	}
+	fingerprint := certidp.GenerateFingerprint(link.Leaf)
+	// Used for debug/operator only, not match
+	subj := certidp.GetSubjectDNForm(link.Leaf)
+	var rawResp []byte
+	var ocspr *ocsp.Response
+	var useCachedResp bool
+	var rc = s.ocsprc
+	var cachedRevocation bool
+	// Check our cache before calling out to the CA OCSP responder
+	s.Debugf(certidp.DbgCheckingCacheForCert, subj, fingerprint)
+	if rawResp = rc.Get(fingerprint, sLogs); len(rawResp) > 0 {
+		// Signature validation of CA's OCSP response occurs in ParseResponse
+		ocspr, err = ocsp.ParseResponse(rawResp, link.Issuer)
+		if err == nil && ocspr != nil {
+			// Check if OCSP Response delegation present and if so is valid
+			if !certidp.ValidDelegationCheck(link.Issuer, ocspr) {
+				// Invalid delegation was already in cache, purge it and don't use it
+				s.Debugf(certidp.MsgCachedOCSPResponseInvalid, subj)
+				rc.Delete(fingerprint, true, sLogs)
+				goto AFTERCACHE
+			}
+			if certidp.OCSPResponseCurrent(ocspr, opts, sLogs) {
+				s.Debugf(certidp.DbgCurrentResponseCached, certidp.GetStatusAssertionStr(ocspr.Status))
+				useCachedResp = true
+			} else {
+				// Cached response is not current, delete it and tidy runtime stats to reflect a miss;
+				// if preserve_revoked is enabled, the cache will not delete the cached response
+				s.Debugf(certidp.DbgExpiredResponseCached, certidp.GetStatusAssertionStr(ocspr.Status))
+				rc.Delete(fingerprint, true, sLogs)
+			}
+			// Regardless of currency, record a cached revocation found in case AllowWhenCAUnreachable is set
+			if ocspr.Status == ocsp.Revoked {
+				cachedRevocation = true
+			}
+		} else {
+			// Bogus cached assertion, purge it and don't use it
+			s.Debugf(certidp.MsgCachedOCSPResponseInvalid, subj, fingerprint)
+			rc.Delete(fingerprint, true, sLogs)
+			goto AFTERCACHE
+		}
+	}
+AFTERCACHE:
+	if !useCachedResp {
+		// CA OCSP responder callout needed
+		rawResp, err = certidp.FetchOCSPResponse(link, opts, sLogs)
+		if err != nil || rawResp == nil || len(rawResp) == 0 {
+			s.Warnf(certidp.ErrCAResponderCalloutFail, subj, err)
+			if opts.WarnOnly {
+				s.Warnf(certidp.MsgAllowWarnOnlyOccurred, subj)
+				return _EMPTY_, true
+			}
+			if opts.AllowWhenCAUnreachable && !cachedRevocation {
+				// Link has no cached history of revocation, so allow it to pass
+				s.Warnf(certidp.MsgAllowWhenCAUnreachableOccurred, subj)
+				return _EMPTY_, true
+			} else if opts.AllowWhenCAUnreachable {
+				// Link has cached but expired revocation so reject when CA is unreachable
+				s.Warnf(certidp.MsgAllowWhenCAUnreachableOccurredCachedRevoke, subj)
+			}
+			return certidp.MsgFailedOCSPResponseFetch, false
+		}
+		// Signature validation of CA's OCSP response occurs in ParseResponse
+		ocspr, err = ocsp.ParseResponse(rawResp, link.Issuer)
+		if err == nil && ocspr != nil {
+			// Check if OCSP Response delegation present and if so is valid
+			if !certidp.ValidDelegationCheck(link.Issuer, ocspr) {
+				s.Warnf(certidp.MsgOCSPResponseDelegationInvalid, subj)
+				if opts.WarnOnly {
+					// Can't use bogus assertion, but warn-only set so allow link to pass
+					s.Warnf(certidp.MsgAllowWarnOnlyOccurred, subj)
+					return _EMPTY_, true
+				}
+				return fmt.Sprintf(certidp.MsgOCSPResponseDelegationInvalid, subj), false
+			}
+			if !certidp.OCSPResponseCurrent(ocspr, opts, sLogs) {
+				s.Warnf(certidp.ErrNewCAResponseNotCurrent, subj)
+				if opts.WarnOnly {
+					// Can't use non-effective assertion, but warn-only set so allow link to pass
+					s.Warnf(certidp.MsgAllowWarnOnlyOccurred, subj)
+					return _EMPTY_, true
+				}
+				return certidp.MsgOCSPResponseNotEffective, false
+			}
+		} else {
+			s.Errorf(certidp.ErrCAResponseParseFailed, subj, err)
+			if opts.WarnOnly {
+				// Can't use bogus assertion, but warn-only set so allow link to pass
+				s.Warnf(certidp.MsgAllowWarnOnlyOccurred, subj)
+				return _EMPTY_, true
+			}
+			return certidp.MsgFailedOCSPResponseParse, false
+		}
+		// cache the valid fetched CA OCSP Response
+		rc.Put(fingerprint, ocspr, subj, sLogs)
+	}
+
+	// Whether through valid cache response available or newly fetched valid response, now check the status
+	if ocspr.Status == ocsp.Revoked || (ocspr.Status == ocsp.Unknown && !opts.UnknownIsGood) {
+		s.Warnf(certidp.ErrOCSPInvalidPeerLink, subj, certidp.GetStatusAssertionStr(ocspr.Status))
+		if opts.WarnOnly {
+			s.Warnf(certidp.MsgAllowWarnOnlyOccurred, subj)
+			return _EMPTY_, true
+		}
+		return fmt.Sprintf(certidp.MsgOCSPResponseInvalidStatus, certidp.GetStatusAssertionStr(ocspr.Status)), false
+	}
+	s.Debugf(certidp.DbgOCSPValidPeerLink, subj)
+	return _EMPTY_, true
+}
diff --git a/server/ocsp_responsecache.go b/server/ocsp_responsecache.go
new file mode 100644
index 00000000..b64c7fad
--- /dev/null
+++ b/server/ocsp_responsecache.go
@@ -0,0 +1,636 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/klauspost/compress/s2"
+	"golang.org/x/crypto/ocsp"
+
+	"github.com/nats-io/nats-server/v2/server/certidp"
+)
+
+const (
+	OCSPResponseCacheDefaultDir            = "_rc_"
+	OCSPResponseCacheDefaultFilename       = "cache.json"
+	OCSPResponseCacheDefaultTempFilePrefix = "ocsprc-*"
+	OCSPResponseCacheMinimumSaveInterval   = 1 * time.Second
+	OCSPResponseCacheDefaultSaveInterval   = 5 * time.Minute
+)
+
+type OCSPResponseCacheType int
+
+const (
+	NONE OCSPResponseCacheType = iota + 1
+	LOCAL
+)
+
+var OCSPResponseCacheTypeMap = map[string]OCSPResponseCacheType{
+	"none":  NONE,
+	"local": LOCAL,
+}
+
+type OCSPResponseCacheConfig struct {
+	Type            OCSPResponseCacheType
+	LocalStore      string
+	PreserveRevoked bool
+	SaveInterval    float64
+}
+
+func NewOCSPResponseCacheConfig() *OCSPResponseCacheConfig {
+	return &OCSPResponseCacheConfig{
+		Type:            LOCAL,
+		LocalStore:      OCSPResponseCacheDefaultDir,
+		PreserveRevoked: false,
+		SaveInterval:    OCSPResponseCacheDefaultSaveInterval.Seconds(),
+	}
+}
+
+type OCSPResponseCacheStats struct {
+	Responses int64 `json:"size"`
+	Hits      int64 `json:"hits"`
+	Misses    int64 `json:"misses"`
+	Revokes   int64 `json:"revokes"`
+	Goods     int64 `json:"goods"`
+	Unknowns  int64 `json:"unknowns"`
+}
+
+type OCSPResponseCacheItem struct {
+	Subject     string                  `json:"subject,omitempty"`
+	CachedAt    time.Time               `json:"cached_at"`
+	RespStatus  certidp.StatusAssertion `json:"resp_status"`
+	RespExpires time.Time               `json:"resp_expires,omitempty"`
+	Resp        []byte                  `json:"resp"`
+}
+
+type OCSPResponseCache interface {
+	Put(key string, resp *ocsp.Response, subj string, log *certidp.Log)
+	Get(key string, log *certidp.Log) []byte
+	Delete(key string, miss bool, log *certidp.Log)
+	Type() string
+	Start(s *Server)
+	Stop(s *Server)
+	Online() bool
+	Config() *OCSPResponseCacheConfig
+	Stats() *OCSPResponseCacheStats
+}
+
+// NoOpCache is a no-op implementation of OCSPResponseCache
+type NoOpCache struct {
+	config *OCSPResponseCacheConfig
+	stats  *OCSPResponseCacheStats
+	online bool
+	mu     *sync.RWMutex
+}
+
+func (c *NoOpCache) Put(_ string, _ *ocsp.Response, _ string, _ *certidp.Log) {}
+
+func (c *NoOpCache) Get(_ string, _ *certidp.Log) []byte {
+	return nil
+}
+
+func (c *NoOpCache) Delete(_ string, _ bool, _ *certidp.Log) {}
+
+func (c *NoOpCache) Start(_ *Server) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.stats = &OCSPResponseCacheStats{}
+	c.online = true
+}
+
+func (c *NoOpCache) Stop(_ *Server) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.online = false
+}
+
+func (c *NoOpCache) Online() bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.online
+}
+
+func (c *NoOpCache) Type() string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return "none"
+}
+
+func (c *NoOpCache) Config() *OCSPResponseCacheConfig {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.config
+}
+
+func (c *NoOpCache) Stats() *OCSPResponseCacheStats {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.stats
+}
+
+// LocalCache is a local file implementation of OCSPResponseCache
+type LocalCache struct {
+	config       *OCSPResponseCacheConfig
+	stats        *OCSPResponseCacheStats
+	online       bool
+	cache        map[string]OCSPResponseCacheItem
+	mu           *sync.RWMutex
+	saveInterval time.Duration
+	dirty        bool
+	timer        *time.Timer
+}
+
+// Put captures a CA OCSP response to the OCSP peer cache indexed by response fingerprint (a hash)
+func (c *LocalCache) Put(key string, caResp *ocsp.Response, subj string, log *certidp.Log) {
+	c.mu.RLock()
+	if !c.online || caResp == nil || key == "" {
+		c.mu.RUnlock()
+		return
+	}
+	c.mu.RUnlock()
+	log.Debugf(certidp.DbgCachingResponse, subj, key)
+	rawC, err := c.Compress(caResp.Raw)
+	if err != nil {
+		log.Errorf(certidp.ErrResponseCompressFail, key, err)
+		return
+	}
+	log.Debugf(certidp.DbgAchievedCompression, float64(len(rawC))/float64(len(caResp.Raw)))
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	// check if we are replacing and do stats
+	item, ok := c.cache[key]
+	if ok {
+		c.adjustStats(-1, item.RespStatus)
+	}
+	item = OCSPResponseCacheItem{
+		Subject:     subj,
+		CachedAt:    time.Now().UTC().Round(time.Second),
+		RespStatus:  certidp.StatusAssertionIntToVal[caResp.Status],
+		RespExpires: caResp.NextUpdate,
+		Resp:        rawC,
+	}
+	c.cache[key] = item
+	c.adjustStats(1, item.RespStatus)
+	c.dirty = true
+}
+
+// Get returns a CA OCSP response from the OCSP peer cache matching the response fingerprint (a hash)
+func (c *LocalCache) Get(key string, log *certidp.Log) []byte {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if !c.online || key == "" {
+		return nil
+	}
+	val, ok := c.cache[key]
+	if ok {
+		atomic.AddInt64(&c.stats.Hits, 1)
+		log.Debugf(certidp.DbgCacheHit, key)
+	} else {
+		atomic.AddInt64(&c.stats.Misses, 1)
+		log.Debugf(certidp.DbgCacheMiss, key)
+		return nil
+	}
+	resp, err := c.Decompress(val.Resp)
+	if err != nil {
+		log.Errorf(certidp.ErrResponseDecompressFail, key, err)
+		return nil
+	}
+	return resp
+}
+
+func (c *LocalCache) adjustStatsHitToMiss() {
+	atomic.AddInt64(&c.stats.Misses, 1)
+	atomic.AddInt64(&c.stats.Hits, -1)
+}
+
+func (c *LocalCache) adjustStats(delta int64, rs certidp.StatusAssertion) {
+	if delta == 0 {
+		return
+	}
+	atomic.AddInt64(&c.stats.Responses, delta)
+	switch rs {
+	case ocsp.Good:
+		atomic.AddInt64(&c.stats.Goods, delta)
+	case ocsp.Revoked:
+		atomic.AddInt64(&c.stats.Revokes, delta)
+	case ocsp.Unknown:
+		atomic.AddInt64(&c.stats.Unknowns, delta)
+	}
+}
+
+// Delete removes a CA OCSP response from the OCSP peer cache matching the response fingerprint (a hash)
+func (c *LocalCache) Delete(key string, wasMiss bool, log *certidp.Log) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if !c.online || key == "" || c.config == nil {
+		return
+	}
+	item, ok := c.cache[key]
+	if !ok {
+		return
+	}
+	if item.RespStatus == ocsp.Revoked && c.config.PreserveRevoked {
+		log.Debugf(certidp.DbgPreservedRevocation, key)
+		if wasMiss {
+			c.adjustStatsHitToMiss()
+		}
+		return
+	}
+	log.Debugf(certidp.DbgDeletingCacheResponse, key)
+	delete(c.cache, key)
+	c.adjustStats(-1, item.RespStatus)
+	if wasMiss {
+		c.adjustStatsHitToMiss()
+	}
+	c.dirty = true
+}
+
+// Start initializes the configured OCSP peer cache, loads a saved cache from disk (if present), and initializes runtime statistics
+func (c *LocalCache) Start(s *Server) {
+	s.Debugf(certidp.DbgStartingCache)
+	c.loadCache(s)
+	c.initStats()
+	c.mu.Lock()
+	c.online = true
+	c.mu.Unlock()
+}
+
+func (c *LocalCache) Stop(s *Server) {
+	c.mu.Lock()
+	s.Debugf(certidp.DbgStoppingCache)
+	c.online = false
+	c.timer.Stop()
+	c.mu.Unlock()
+	c.saveCache(s)
+}
+
+func (c *LocalCache) Online() bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.online
+}
+
+func (c *LocalCache) Type() string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return "local"
+}
+
+func (c *LocalCache) Config() *OCSPResponseCacheConfig {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.config
+}
+
+func (c *LocalCache) Stats() *OCSPResponseCacheStats {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if c.stats == nil {
+		return nil
+	}
+	stats := OCSPResponseCacheStats{
+		Responses: c.stats.Responses,
+		Hits:      c.stats.Hits,
+		Misses:    c.stats.Misses,
+		Revokes:   c.stats.Revokes,
+		Goods:     c.stats.Goods,
+		Unknowns:  c.stats.Unknowns,
+	}
+	return &stats
+}
+
+func (c *LocalCache) initStats() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.stats = &OCSPResponseCacheStats{}
+	c.stats.Hits = 0
+	c.stats.Misses = 0
+	c.stats.Responses = int64(len(c.cache))
+	for _, resp := range c.cache {
+		switch resp.RespStatus {
+		case ocsp.Good:
+			c.stats.Goods++
+		case ocsp.Revoked:
+			c.stats.Revokes++
+		case ocsp.Unknown:
+			c.stats.Unknowns++
+		}
+	}
+}
+
+func (c *LocalCache) Compress(buf []byte) ([]byte, error) {
+	bodyLen := int64(len(buf))
+	var output bytes.Buffer
+	writer := s2.NewWriter(&output)
+	input := bytes.NewReader(buf[:bodyLen])
+	if n, err := io.CopyN(writer, input, bodyLen); err != nil {
+		return nil, fmt.Errorf(certidp.ErrCannotWriteCompressed, err)
+	} else if n != bodyLen {
+		return nil, fmt.Errorf(certidp.ErrTruncatedWrite, n, bodyLen)
+	}
+	if err := writer.Close(); err != nil {
+		return nil, fmt.Errorf(certidp.ErrCannotCloseWriter, err)
+	}
+	return output.Bytes(), nil
+}
+
+func (c *LocalCache) Decompress(buf []byte) ([]byte, error) {
+	bodyLen := int64(len(buf))
+	input := bytes.NewReader(buf[:bodyLen])
+	reader := io.NopCloser(s2.NewReader(input))
+	output, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, fmt.Errorf(certidp.ErrCannotReadCompressed, err)
+	}
+	return output, reader.Close()
+}
+
+func (c *LocalCache) loadCache(s *Server) {
+	d := s.opts.OCSPCacheConfig.LocalStore
+	if d == _EMPTY_ {
+		d = OCSPResponseCacheDefaultDir
+	}
+	f := OCSPResponseCacheDefaultFilename
+	store, err := filepath.Abs(path.Join(d, f))
+	if err != nil {
+		s.Errorf(certidp.ErrLoadCacheFail, err)
+		return
+	}
+	s.Debugf(certidp.DbgLoadingCache, store)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cache = make(map[string]OCSPResponseCacheItem)
+	dat, err := os.ReadFile(store)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			s.Debugf(certidp.DbgNoCacheFound)
+		} else {
+			s.Warnf(certidp.ErrLoadCacheFail, err)
+		}
+		return
+	}
+	err = json.Unmarshal(dat, &c.cache)
+	if err != nil {
+		// make sure clean cache
+		c.cache = make(map[string]OCSPResponseCacheItem)
+		s.Warnf(certidp.ErrLoadCacheFail, err)
+		c.dirty = true
+		return
+	}
+	c.dirty = false
+}
+
+func (c *LocalCache) saveCache(s *Server) {
+	c.mu.RLock()
+	dirty := c.dirty
+	c.mu.RUnlock()
+	if !dirty {
+		return
+	}
+	s.Debugf(certidp.DbgCacheDirtySave)
+	var d string
+	if c.config.LocalStore != _EMPTY_ {
+		d = c.config.LocalStore
+	} else {
+		d = OCSPResponseCacheDefaultDir
+	}
+	f := OCSPResponseCacheDefaultFilename
+	store, err := filepath.Abs(path.Join(d, f))
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	s.Debugf(certidp.DbgSavingCache, store)
+	if _, err := os.Stat(d); os.IsNotExist(err) {
+		err = os.Mkdir(d, defaultDirPerms)
+		if err != nil {
+			s.Errorf(certidp.ErrSaveCacheFail, err)
+			return
+		}
+	}
+	tmp, err := os.CreateTemp(d, OCSPResponseCacheDefaultTempFilePrefix)
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	defer func() {
+		tmp.Close()
+		os.Remove(tmp.Name())
+	}() // clean up any temp files
+
+	// RW lock here because we're going to snapshot the cache to disk and mark as clean if successful
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	dat, err := json.MarshalIndent(c.cache, "", " ")
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	cacheSize, err := tmp.Write(dat)
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	err = tmp.Sync()
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	err = tmp.Close()
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	// do the final swap and overwrite any old saved peer cache
+	err = os.Rename(tmp.Name(), store)
+	if err != nil {
+		s.Errorf(certidp.ErrSaveCacheFail, err)
+		return
+	}
+	c.dirty = false
+	s.Debugf(certidp.DbgCacheSaved, cacheSize)
+}
+
+var OCSPResponseCacheUsage = `
+You may enable OCSP peer response cacheing at server configuration root level:
+
+(If no TLS blocks are configured with OCSP peer verification, ocsp_cache is ignored.)
+
+    ...
+    # short form enables with defaults
+    ocsp_cache: true
+
+    # if false or undefined and one or more TLS blocks are configured with OCSP peer verification, "none" is implied
+
+    # long form includes settable options
+    ocsp_cache {
+
+        # Cache type <none, local> (default local)
+        type: local
+
+        # Cache file directory for local-type cache (default _rc_ in current working directory)
+        local_store: "_rc_"
+
+        # Ignore cache deletes if cached OCSP response is Revoked status (default false)
+        preserve_revoked: false
+
+        # For local store, interval to save in-memory cache to disk in seconds (default 300 seconds, minimum 1 second)
+        save_interval: 300
+    }
+    ...
+
+Note: Cache of server's own OCSP response (staple) is enabled using the 'ocsp' configuration option.
+`
+
+func (s *Server) initOCSPResponseCache() {
+	// No mTLS OCSP or Leaf OCSP enablements, so no need to init cache
+	s.mu.RLock()
+	if !s.ocspPeerVerify {
+		s.mu.RUnlock()
+		return
+	}
+	s.mu.RUnlock()
+	so := s.getOpts()
+	if so.OCSPCacheConfig == nil {
+		so.OCSPCacheConfig = NewOCSPResponseCacheConfig()
+	}
+	var cc = so.OCSPCacheConfig
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	switch cc.Type {
+	case NONE:
+		s.ocsprc = &NoOpCache{config: cc, online: true, mu: &sync.RWMutex{}}
+	case LOCAL:
+		c := &LocalCache{
+			config: cc,
+			online: false,
+			cache:  make(map[string]OCSPResponseCacheItem),
+			mu:     &sync.RWMutex{},
+			dirty:  false,
+		}
+		c.saveInterval = time.Duration(cc.SaveInterval) * time.Second
+		c.timer = time.AfterFunc(c.saveInterval, func() {
+			s.Debugf(certidp.DbgCacheSaveTimerExpired)
+			c.saveCache(s)
+			c.timer.Reset(c.saveInterval)
+		})
+		s.ocsprc = c
+	default:
+		s.Fatalf(certidp.ErrBadCacheTypeConfig, cc.Type)
+	}
+}
+
+func (s *Server) startOCSPResponseCache() {
+	// No mTLS OCSP or Leaf OCSP enablements, so no need to start cache
+	s.mu.RLock()
+	if !s.ocspPeerVerify || s.ocsprc == nil {
+		s.mu.RUnlock()
+		return
+	}
+	s.mu.RUnlock()
+
+	// Could be heavier operation depending on cache implementation
+	s.ocsprc.Start(s)
+	if s.ocsprc.Online() {
+		s.Noticef(certidp.MsgCacheOnline, s.ocsprc.Type())
+	} else {
+		s.Noticef(certidp.MsgCacheOffline, s.ocsprc.Type())
+	}
+}
+
+func (s *Server) stopOCSPResponseCache() {
+	s.mu.RLock()
+	if s.ocsprc == nil {
+		s.mu.RUnlock()
+		return
+	}
+	s.mu.RUnlock()
+	s.ocsprc.Stop(s)
+}
+
+func parseOCSPResponseCache(v interface{}) (pcfg *OCSPResponseCacheConfig, retError error) {
+	var lt token
+	defer convertPanicToError(&lt, &retError)
+	tk, v := unwrapValue(v, &lt)
+	cm, ok := v.(map[string]interface{})
+	if !ok {
+		return nil, &configErr{tk, fmt.Sprintf(certidp.ErrIllegalCacheOptsConfig, v)}
+	}
+	pcfg = NewOCSPResponseCacheConfig()
+	retError = nil
+	for mk, mv := range cm {
+		// Again, unwrap token value if line check is required.
+		tk, mv = unwrapValue(mv, &lt)
+		switch strings.ToLower(mk) {
+		case "type":
+			cache, ok := mv.(string)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingCacheOptFieldGeneric, mk)}
+			}
+			cacheType, exists := OCSPResponseCacheTypeMap[strings.ToLower(cache)]
+			if !exists {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrUnknownCacheType, cache)}
+			}
+			pcfg.Type = cacheType
+		case "local_store":
+			store, ok := mv.(string)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingCacheOptFieldGeneric, mk)}
+			}
+			pcfg.LocalStore = store
+		case "preserve_revoked":
+			preserve, ok := mv.(bool)
+			if !ok {
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingCacheOptFieldGeneric, mk)}
+			}
+			pcfg.PreserveRevoked = preserve
+		case "save_interval":
+			at := float64(0)
+			switch mv := mv.(type) {
+			case int64:
+				at = float64(mv)
+			case float64:
+				at = mv
+			case string:
+				d, err := time.ParseDuration(mv)
+				if err != nil {
+					return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldTypeConversion, err)}
+				}
+				at = d.Seconds()
+			default:
+				return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingCacheOptFieldTypeConversion, "unexpected type")}
+			}
+			si := time.Duration(at) * time.Second
+			if si < OCSPResponseCacheMinimumSaveInterval {
+				si = OCSPResponseCacheMinimumSaveInterval
+			}
+			pcfg.SaveInterval = si.Seconds()
+		default:
+			return nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingCacheOptFieldGeneric, mk)}
+		}
+	}
+	return pcfg, nil
+}
diff --git a/server/opts.go b/server/opts.go
index ca45d585..a2b231aa 100644
--- a/server/opts.go
+++ b/server/opts.go
@@ -1,4 +1,4 @@
-// Copyright 2012-2022 The NATS Authors
+// Copyright 2012-2023 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -35,6 +35,7 @@ import (
 
 	"github.com/nats-io/jwt/v2"
 	"github.com/nats-io/nats-server/v2/conf"
+	"github.com/nats-io/nats-server/v2/server/certidp"
 	"github.com/nats-io/nats-server/v2/server/certstore"
 	"github.com/nats-io/nkeys"
 )
@@ -341,6 +342,9 @@ type Options struct {
 	// JetStream
 	maxMemSet   bool
 	maxStoreSet bool
+
+	// OCSP Cache config enables next-gen cache for OCSP features
+	OCSPCacheConfig *OCSPResponseCacheConfig
 }
 
 // WebsocketOpts are options for websocket
@@ -404,6 +408,9 @@ type WebsocketOpts struct {
 	// and write the response back to the client. This include the
 	// time needed for the TLS Handshake.
 	HandshakeTimeout time.Duration
+
+	// Snapshot of configured TLS options.
+	tlsConfigOpts *TLSConfigOpts
 }
 
 // MQTTOpts are options for MQTT
@@ -484,6 +491,9 @@ type MQTTOpts struct {
 	// subscription ending with "#" will use 2 times the MaxAckPending value.
 	// Note that changes to this option is applied only to new subscriptions.
 	MaxAckPending uint16
+
+	// Snapshot of configured TLS options.
+	tlsConfigOpts *TLSConfigOpts
 }
 
 type netResolver interface {
@@ -578,6 +588,7 @@ type TLSConfigOpts struct {
 	CertStore         certstore.StoreType
 	CertMatchBy       certstore.MatchByType
 	CertMatch         string
+	OCSPPeerConfig    *certidp.OCSPPeerConfig
 }
 
 // OCSPConfig represents the options of OCSP stapling options.
@@ -1408,6 +1419,34 @@ func (o *Options) processConfigFileLine(k string, v interface{}, errors *[]error
 			m[kk] = v.(string)
 		}
 		o.JsAccDefaultDomain = m
+	case "ocsp_cache":
+		var err error
+		switch vv := v.(type) {
+		case bool:
+			pc := NewOCSPResponseCacheConfig()
+			if vv {
+				// Set enabled
+				pc.Type = LOCAL
+				o.OCSPCacheConfig = pc
+			} else {
+				// Set disabled (none cache)
+				pc.Type = NONE
+				o.OCSPCacheConfig = pc
+			}
+		case map[string]interface{}:
+			pc, err := parseOCSPResponseCache(v)
+			if err != nil {
+				*errors = append(*errors, err)
+				return
+			}
+			o.OCSPCacheConfig = pc
+		default:
+			err = &configErr{tk, fmt.Sprintf("error parsing tags: unsupported type %T", v)}
+		}
+		if err != nil {
+			*errors = append(*errors, err)
+			return
+		}
 	default:
 		if au := atomic.LoadInt32(&allowUnknownTopLevelField); au == 0 && !tk.IsUsedVariable() {
 			err := &unknownConfigFieldErr{
@@ -3863,8 +3902,10 @@ func PrintTLSHelpAndDie() {
 		fmt.Printf("    %s\n", k)
 	}
 	if runtime.GOOS == "windows" {
-		fmt.Printf("%s", certstore.Usage)
+		fmt.Printf("%s\n", certstore.Usage)
 	}
+	fmt.Printf("%s", certidp.OCSPPeerUsage)
+	fmt.Printf("%s", OCSPResponseCacheUsage)
 	os.Exit(0)
 }
 
@@ -4048,6 +4089,28 @@ func parseTLS(v interface{}, isClientCtx bool) (t *TLSConfigOpts, retErr error)
 				return nil, &configErr{tk, certstore.ErrBadCertMatchField.Error()}
 			}
 			tc.CertMatch = certMatch
+		case "ocsp_peer":
+			switch vv := mv.(type) {
+			case bool:
+				pc := certidp.NewOCSPPeerConfig()
+				if vv {
+					// Set enabled
+					pc.Verify = true
+					tc.OCSPPeerConfig = pc
+				} else {
+					// Set disabled
+					pc.Verify = false
+					tc.OCSPPeerConfig = pc
+				}
+			case map[string]interface{}:
+				pc, err := parseOCSPPeer(mv)
+				if err != nil {
+					return nil, &configErr{tk, err.Error()}
+				}
+				tc.OCSPPeerConfig = pc
+			default:
+				return nil, &configErr{tk, fmt.Sprintf("error parsing ocsp peer config: unsupported type %T", v)}
+			}
 		default:
 			return nil, &configErr{tk, fmt.Sprintf("error parsing tls config, unknown field [%q]", mk)}
 		}
@@ -4178,6 +4241,7 @@ func parseWebsocket(v interface{}, o *Options, errors *[]error, warnings *[]erro
 			}
 			o.Websocket.TLSMap = tc.Map
 			o.Websocket.TLSPinnedCerts = tc.PinnedCerts
+			o.Websocket.tlsConfigOpts = tc
 		case "same_origin":
 			o.Websocket.SameOrigin = mv.(bool)
 		case "allowed_origins", "allowed_origin", "allow_origins", "allow_origin", "origins", "origin":
@@ -4268,6 +4332,7 @@ func parseMQTT(v interface{}, o *Options, errors *[]error, warnings *[]error) er
 			o.MQTT.TLSTimeout = tc.Timeout
 			o.MQTT.TLSMap = tc.Map
 			o.MQTT.TLSPinnedCerts = tc.PinnedCerts
+			o.MQTT.tlsConfigOpts = tc
 		case "authorization", "authentication":
 			auth := parseSimpleAuth(tk, errors, warnings)
 			o.MQTT.Username = auth.user
diff --git a/server/reload.go b/server/reload.go
index dd2e25d5..35e97b52 100644
--- a/server/reload.go
+++ b/server/reload.go
@@ -620,7 +620,7 @@ func (jso jetStreamOption) IsStatszChange() bool {
 }
 
 type ocspOption struct {
-	noopOption
+	tlsOption
 	newValue *OCSPConfig
 }
 
@@ -628,6 +628,15 @@ func (a *ocspOption) Apply(s *Server) {
 	s.Noticef("Reloaded: OCSP")
 }
 
+type ocspResponseCacheOption struct {
+	tlsOption
+	newValue *OCSPResponseCacheConfig
+}
+
+func (a *ocspResponseCacheOption) Apply(s *Server) {
+	s.Noticef("Reloaded OCSP peer cache")
+}
+
 // connectErrorReports implements the option interface for the `connect_error_reports`
 // setting.
 type connectErrorReports struct {
@@ -951,7 +960,7 @@ func imposeOrder(value interface{}) error {
 		sort.Strings(value.AllowedOrigins)
 	case string, bool, uint8, int, int32, int64, time.Duration, float64, nil, LeafNodeOpts, ClusterOpts, *tls.Config, PinnedCertSet,
 		*URLAccResolver, *MemAccResolver, *DirAccResolver, *CacheDirAccResolver, Authentication, MQTTOpts, jwt.TagList,
-		*OCSPConfig, map[string]string, JSLimitOpts, StoreCipher:
+		*OCSPConfig, map[string]string, JSLimitOpts, StoreCipher, *OCSPResponseCacheConfig:
 		// explicitly skipped types
 	default:
 		// this will fail during unit tests
@@ -1277,8 +1286,8 @@ func (s *Server) diffOptions(newOpts *Options) ([]option, error) {
 			// Similar to gateways
 			tmpOld := oldValue.(WebsocketOpts)
 			tmpNew := newValue.(WebsocketOpts)
-			tmpOld.TLSConfig = nil
-			tmpNew.TLSConfig = nil
+			tmpOld.TLSConfig, tmpOld.tlsConfigOpts = nil, nil
+			tmpNew.TLSConfig, tmpNew.tlsConfigOpts = nil, nil
 			// If there is really a change prevents reload.
 			if !reflect.DeepEqual(tmpOld, tmpNew) {
 				// See TODO(ik) note below about printing old/new values.
@@ -1297,9 +1306,9 @@ func (s *Server) diffOptions(newOpts *Options) ([]option, error) {
 			// we only fail reload if some that we don't support are changed.
 			tmpOld := oldValue.(MQTTOpts)
 			tmpNew := newValue.(MQTTOpts)
-			tmpOld.TLSConfig, tmpOld.AckWait, tmpOld.MaxAckPending, tmpOld.StreamReplicas, tmpOld.ConsumerReplicas, tmpOld.ConsumerMemoryStorage = nil, 0, 0, 0, 0, false
+			tmpOld.TLSConfig, tmpOld.tlsConfigOpts, tmpOld.AckWait, tmpOld.MaxAckPending, tmpOld.StreamReplicas, tmpOld.ConsumerReplicas, tmpOld.ConsumerMemoryStorage = nil, nil, 0, 0, 0, 0, false
 			tmpOld.ConsumerInactiveThreshold = 0
-			tmpNew.TLSConfig, tmpNew.AckWait, tmpNew.MaxAckPending, tmpNew.StreamReplicas, tmpNew.ConsumerReplicas, tmpNew.ConsumerMemoryStorage = nil, 0, 0, 0, 0, false
+			tmpNew.TLSConfig, tmpNew.tlsConfigOpts, tmpNew.AckWait, tmpNew.MaxAckPending, tmpNew.StreamReplicas, tmpNew.ConsumerReplicas, tmpNew.ConsumerMemoryStorage = nil, nil, 0, 0, 0, 0, false
 			tmpNew.ConsumerInactiveThreshold = 0
 
 			if !reflect.DeepEqual(tmpOld, tmpNew) {
@@ -1352,6 +1361,8 @@ func (s *Server) diffOptions(newOpts *Options) ([]option, error) {
 			}
 		case "ocspconfig":
 			diffOpts = append(diffOpts, &ocspOption{newValue: newValue.(*OCSPConfig)})
+		case "ocspcacheconfig":
+			diffOpts = append(diffOpts, &ocspResponseCacheOption{newValue: newValue.(*OCSPResponseCacheConfig)})
 		default:
 			// TODO(ik): Implement String() on those options to have a nice print.
 			// %v is difficult to figure what's what, %+v print private fields and
@@ -1489,10 +1500,12 @@ func (s *Server) applyOptions(ctx *reloadContext, opts []option) {
 		s.updateRemoteLeafNodesTLSConfig(newOpts)
 	}
 
+	// This will fire if TLS enabled at root (NATS listener) -or- if ocsp or ocsp_cache
+	// appear in the config.
 	if reloadTLS {
 		// Restart OCSP monitoring.
 		if err := s.reloadOCSP(); err != nil {
-			s.Warnf("Can't restart OCSP Stapling: %v", err)
+			s.Warnf("Can't restart OCSP features: %v", err)
 		}
 	}
 
diff --git a/server/server.go b/server/server.go
index ea6d08ef..a748a901 100644
--- a/server/server.go
+++ b/server/server.go
@@ -246,6 +246,12 @@ type Server struct {
 	// OCSP monitoring
 	ocsps []*OCSPMonitor
 
+	// OCSP peer verification (at least one TLS block)
+	ocspPeerVerify bool
+
+	// OCSP response cache
+	ocsprc OCSPResponseCache
+
 	// exporting account name the importer experienced issues with
 	incompleteAccExporterMap sync.Map
 
@@ -453,8 +459,8 @@ func NewServer(opts *Options) (*Server, error) {
 	// Ensure that non-exported options (used in tests) are properly set.
 	s.setLeafNodeNonExportedOptions()
 
-	// Setup OCSP Stapling. This will abort server from starting if there
-	// are no valid staples and OCSP policy is set to Always or MustStaple.
+	// Setup OCSP Stapling and OCSP Peer. This will abort server from starting if there
+	// are no valid staples and OCSP Stapling policy is set to Always or MustStaple.
 	if err := s.enableOCSP(); err != nil {
 		return nil, err
 	}
@@ -1901,9 +1907,13 @@ func (s *Server) Start() {
 		}
 	}
 
-	// Start OCSP Stapling monitoring for TLS certificates if enabled.
+	// Start OCSP Stapling monitoring for TLS certificates if enabled. Hook TLS handshake for
+	// OCSP check on peers (LEAF and CLIENT kind) if enabled.
 	s.startOCSPMonitoring()
 
+	// Configure OCSP Response Cache for peer OCSP checks if enabled.
+	s.initOCSPResponseCache()
+
 	// Start up gateway if needed. Do this before starting the routes, because
 	// we want to resolve the gateway host:port so that this information can
 	// be sent to other routes.
@@ -1970,6 +1980,9 @@ func (s *Server) Start() {
 	if !opts.DontListen {
 		s.AcceptLoop(clientListenReady)
 	}
+
+	// Bring OSCP Response cache online after accept loop started in anticipation of NATS-enabled cache types
+	s.startOCSPResponseCache()
 }
 
 // Shutdown will shutdown the server instance by kicking out the AcceptLoop
@@ -2130,6 +2143,12 @@ func (s *Server) Shutdown() {
 	}
 
 	s.Noticef("Server Exiting..")
+
+	// Stop OCSP Response Cache
+	if s.ocsprc != nil {
+		s.ocsprc.Stop(s)
+	}
+
 	// Close logger if applicable. It allows tests on Windows
 	// to be able to do proper cleanup (delete log file).
 	s.logging.RLock()
diff --git a/test/configs/certs/ocsp_peer/mini-ca/caocsp/caocsp_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/caocsp/caocsp_cert.pem
new file mode 100644
index 00000000..b6d024a9
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/caocsp/caocsp_cert.pem
@@ -0,0 +1,91 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            17:37:00:a1:ce:35:e0:84:dd:e9:30:0c:a7:12:b9:50:88:9c:16:07
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:02:58 2023 GMT
+            Not After : Apr 28 19:02:58 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=CA OCSP Responder
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d6:10:15:61:34:1e:97:0d:c6:c2:7d:f2:0f:9a:
+                    35:56:54:7a:9b:9e:a3:0b:ff:31:0d:db:49:4b:98:
+                    e0:64:3a:3c:7f:4f:4b:d0:a8:01:80:c9:68:4e:76:
+                    3b:be:7b:d9:56:8d:d4:fd:bf:e1:6f:d0:5c:88:07:
+                    3f:05:a8:83:b3:7e:0b:ba:e0:36:f6:1c:e0:75:fd:
+                    be:38:26:33:1b:42:96:4e:62:0b:88:36:ef:cc:14:
+                    e3:97:86:dd:c2:78:d3:05:b7:4d:cd:2b:52:f2:11:
+                    16:d2:7e:8f:f3:47:8c:f9:0f:1e:cd:5e:f7:a4:1c:
+                    62:34:03:70:74:89:6b:bc:75:e3:30:82:c1:5b:67:
+                    f3:d1:ca:81:13:10:d8:c5:d8:20:05:6d:d1:e7:51:
+                    19:ac:03:96:2a:a1:21:ff:88:2e:d2:e9:67:79:cf:
+                    ef:17:b5:2b:7c:10:1f:5e:79:3e:08:98:7f:42:bb:
+                    8a:13:17:2d:9a:1a:8d:ff:36:c2:e9:c0:07:ea:cb:
+                    4f:72:35:f7:f2:d9:86:d2:ab:6b:70:2b:57:82:c8:
+                    02:93:aa:04:aa:00:3a:53:23:3d:61:82:32:0e:68:
+                    33:7e:5f:03:52:c9:53:db:e3:26:46:8a:ab:e0:e5:
+                    54:57:0d:e3:e3:24:b8:d9:69:92:0a:fb:bd:51:25:
+                    89:fd
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                D2:00:A2:C3:AA:00:76:1C:E7:67:37:96:89:77:38:69:C5:1B:5E:45
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                OCSP Signing
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b0:36:29:84:91:de:14:e5:db:bf:55:fc:d8:0a:81:b5:df:84:
+        e4:5c:ae:e2:3c:1d:05:09:8a:85:7a:9e:f4:82:61:1b:7b:8a:
+        0f:1d:e3:ad:b0:60:45:12:2e:38:6d:9c:95:d2:42:fe:2e:1a:
+        d2:a5:2c:82:40:1e:6c:4b:35:d1:3c:a6:4c:1c:73:c9:d0:32:
+        e9:47:c9:9a:fa:d0:1a:ef:86:c7:1e:49:ca:62:f1:81:9d:4e:
+        38:35:56:1b:53:fe:4a:f4:4c:91:31:8f:32:70:64:ee:91:f7:
+        4e:fe:ab:c5:1e:84:d1:43:cd:af:f6:5d:2a:b1:4f:b1:f4:1f:
+        5a:9d:33:7a:48:94:c8:88:23:e5:b9:c8:a1:4d:51:4c:d5:3b:
+        5f:f7:e8:e5:e1:53:a6:de:c8:95:14:32:e0:52:db:43:d6:c9:
+        2f:7f:96:07:fb:87:0a:f0:53:3d:ce:e1:56:6f:dc:0e:84:f3:
+        e2:ef:dc:17:0f:59:1f:1a:70:d5:7f:08:36:3d:7e:8e:f8:1f:
+        55:47:9a:96:1b:11:25:d9:27:7f:bf:e1:65:e5:16:ca:d9:bc:
+        6f:5c:5e:a6:4c:d0:7a:24:8d:42:c4:dc:b5:4a:75:4a:7c:88:
+        da:21:5e:27:e1:0c:36:64:69:10:58:81:3d:cd:74:df:50:85:
+        c2:71:fe:43
+-----BEGIN CERTIFICATE-----
+MIIEGzCCAwOgAwIBAgIUFzcAoc414ITd6TAMpxK5UIicFgcwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDI1OFoXDTMzMDQyODE5MDI1OFowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFD
+QSBPQ1NQIFJlc3BvbmRlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANYQFWE0HpcNxsJ98g+aNVZUepueowv/MQ3bSUuY4GQ6PH9PS9CoAYDJaE52O757
+2VaN1P2/4W/QXIgHPwWog7N+C7rgNvYc4HX9vjgmMxtClk5iC4g278wU45eG3cJ4
+0wW3Tc0rUvIRFtJ+j/NHjPkPHs1e96QcYjQDcHSJa7x14zCCwVtn89HKgRMQ2MXY
+IAVt0edRGawDliqhIf+ILtLpZ3nP7xe1K3wQH155PgiYf0K7ihMXLZoajf82wunA
+B+rLT3I19/LZhtKra3ArV4LIApOqBKoAOlMjPWGCMg5oM35fA1LJU9vjJkaKq+Dl
+VFcN4+MkuNlpkgr7vVElif0CAwEAAaOB4jCB3zAdBgNVHQ4EFgQU0gCiw6oAdhzn
+ZzeWiXc4acUbXkUwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwDAYD
+VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
+AwkwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3Rf
+Y3JsLmRlcjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcu
+MC4wLjE6ODg4OC8wDQYJKoZIhvcNAQELBQADggEBALA2KYSR3hTl279V/NgKgbXf
+hORcruI8HQUJioV6nvSCYRt7ig8d462wYEUSLjhtnJXSQv4uGtKlLIJAHmxLNdE8
+pkwcc8nQMulHyZr60BrvhsceScpi8YGdTjg1VhtT/kr0TJExjzJwZO6R907+q8Ue
+hNFDza/2XSqxT7H0H1qdM3pIlMiII+W5yKFNUUzVO1/36OXhU6beyJUUMuBS20PW
+yS9/lgf7hwrwUz3O4VZv3A6E8+Lv3BcPWR8acNV/CDY9fo74H1VHmpYbESXZJ3+/
+4WXlFsrZvG9cXqZM0HokjULE3LVKdUp8iNohXifhDDZkaRBYgT3NdN9QhcJx/kM=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/caocsp/private/caocsp_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/caocsp/private/caocsp_keypair.pem
new file mode 100644
index 00000000..e3ac9b3a
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/caocsp/private/caocsp_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDWEBVhNB6XDcbC
+ffIPmjVWVHqbnqML/zEN20lLmOBkOjx/T0vQqAGAyWhOdju+e9lWjdT9v+Fv0FyI
+Bz8FqIOzfgu64Db2HOB1/b44JjMbQpZOYguINu/MFOOXht3CeNMFt03NK1LyERbS
+fo/zR4z5Dx7NXvekHGI0A3B0iWu8deMwgsFbZ/PRyoETENjF2CAFbdHnURmsA5Yq
+oSH/iC7S6Wd5z+8XtSt8EB9eeT4ImH9Cu4oTFy2aGo3/NsLpwAfqy09yNffy2YbS
+q2twK1eCyAKTqgSqADpTIz1hgjIOaDN+XwNSyVPb4yZGiqvg5VRXDePjJLjZaZIK
++71RJYn9AgMBAAECggEACnoECdtaqervMOKoH7Jc7Oo6i/ZCJZqqRHLYjf4f8VfW
+USbI35/xXuO8mqZ3uxVlqDJN29NxzZ6lgLTWFUlPlM/U9CL4HaiBJdUy452e/7UN
+FS4AQXzq1JKrJuXfYZ63OT7k7Gcz6owCkW/HTNFSKXhfeg6tURdgiQooDVQSdUk6
+xX4gVEK3skozRXf4mrjTaNnFCOk2+sZdqrRn19ZAUGRisv6ECf8/wQlh3+ySfPYV
+u+BHQqzntToYP0HUZAO6rezcTVayW25E+AaOqNdNmSqcOX218ohVCzwzFpzIk8LW
+jYLyGQBhHHcw+RHJeitcHrDuTTpOZFznQxzHiGH3AwKBgQD91TNHx9Y9jUBkISSi
+XylSiZEAOjPl4VrhRfI5OUx1l3XTqB/e3xBYLwxEpXjs7m3qyXhCe+rVuIwSjLzc
+mLCspPZw/fxdRefWW5B+v1HbHxC3/lBOhqaDfLL6x4A/q3n/itG9X0GjpfvRkdJY
+GYOJea/2rJuMsFs3atX160p4cwKBgQDX4/VXJWxxWUJbObwoxxABG9VTZdI6Dsqr
+8tgg+7NPqw3PAo5W+XLsGZCSWQfJTD49AHcHBon5IfEDa5srfKsOXFXoiNEdCjIG
+zJ9mNtGMokXOWLKgxMoqHz+WnqWgxi9D7QwWWNq5hWnACJUqeqelRMzoNkmr96DX
+NloqHREHzwKBgQC0jKnlLOfe8FIU5t5AAKBL7T4Og1fW8+zIwBADVBZmrk1JOBUz
+Wkct8okvauQQ46ebkaLQ54OqcZJwv1q3LoS8yLnitUaEseyuNIMbJMr8qaQiu+oz
+cOOQM2q7ppw6raYhdoSpxs/Rr4bnEmoj8EH3z26ybyRVdjvrtzppqetWsQKBgQCa
+YogGA9siy6PqPMVTm9bUFCVfeEb4Aa/pesYYACbgaAB98uP7SnNmZ3m9TjGFQCKZ
+2QVFXuW35Q/HVGIonQRuRpWgroZr7+iKeDXdEIKVwU2OHFvRICk6KhJ9EYJ8EH2o
+Y5HrQStY1BElpH2XXRMZ2rN1s6zHb1Pz0whzaUnOfQKBgQCpfJYh1Yzpryb0hkfa
+MAL2Rsw+mpYeJ27Bmv+taW5iEVMQr2AEYNJhQx1SjNZOml2mqY6un4UPwhUwqAqg
+SOgWNQGD5g6xoM6Hom+nZG03QacCYUOaD6xDmVKTY0LnzVBwspfvrIgLKgZ7IWBx
+KlqvY5FJ+NXg3wHLNwgGzkgVPg==
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/System_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/System_bundle.pem
new file mode 100644
index 00000000..e8969069
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/System_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7c:43:65:c7:cf:27:e3:83:ae:2f:60:ac:03:e5:f2:b6:22:88:bc:a2
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=System
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a3:21:2f:74:34:c1:1b:41:90:b6:4e:41:72:e0:
+                    3f:9e:49:94:55:ec:02:4c:dd:14:80:b8:3d:c6:c7:
+                    47:bb:a5:59:c3:35:86:89:17:08:ce:fe:71:e6:2f:
+                    9c:c1:db:d2:7e:14:24:da:61:30:3a:e7:6e:b1:e3:
+                    21:38:81:bc:47:df:b2:7f:1f:60:be:3d:c5:ed:76:
+                    03:94:e3:c4:b3:3e:bf:f8:43:ba:c2:54:bc:bb:66:
+                    59:98:a3:f9:aa:e3:10:e8:c3:88:dc:1a:18:6f:dd:
+                    90:eb:6f:a3:4b:d4:af:34:5c:43:20:d5:5b:e7:98:
+                    a5:7c:7b:a9:15:86:bb:28:bf:ba:e0:bb:f7:1c:08:
+                    c4:26:eb:c1:ac:05:1f:74:4f:05:11:57:e0:12:77:
+                    17:9e:89:dd:a5:38:ee:cf:cf:67:be:0c:5e:6a:4a:
+                    74:61:21:79:8e:c3:28:f1:e2:06:00:2d:ea:3a:6d:
+                    e2:a6:25:fd:2d:8b:f5:82:36:91:8a:21:f0:6a:93:
+                    19:d6:76:08:fd:cd:ee:90:a9:a9:cf:99:30:71:46:
+                    57:ea:fb:c5:65:4f:7c:86:5c:9d:d7:b4:c3:27:3c:
+                    eb:27:dd:bc:55:76:1f:25:0d:cb:6f:43:9a:9f:ba:
+                    de:54:c1:90:03:9e:e5:0d:d9:cd:84:d4:58:74:63:
+                    be:59
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A0:FA:B5:24:42:70:DF:E1:BB:E6:10:62:BE:FE:F5:81:13:2F:31:9B
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:System@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        ad:00:40:7a:34:ad:07:e9:ed:fa:8f:1f:48:08:79:81:a8:3c:
+        90:da:05:95:74:05:51:9c:17:a8:5c:03:09:c8:f8:2c:09:64:
+        e2:7c:fc:69:e1:c0:5d:8a:d9:f0:f3:e4:cd:2c:5e:43:77:71:
+        f8:58:20:88:8f:63:e1:b4:86:db:7a:54:df:ce:be:01:e2:55:
+        a2:70:a8:89:64:cf:2a:13:78:91:de:83:ed:d6:74:24:00:ca:
+        3d:67:4a:cd:e3:82:b9:56:a3:3a:b4:80:b2:ac:61:e9:75:6c:
+        30:1c:81:96:2f:f0:99:b2:7b:73:b5:45:b0:3c:20:ed:54:b3:
+        87:37:9f:5e:07:c4:8a:72:94:53:4e:a2:a0:83:bc:fb:61:59:
+        ff:8c:91:1c:db:ad:7a:e0:12:e3:a3:b1:91:97:d4:c7:ed:02:
+        6e:7e:01:d8:d6:d5:6d:81:a2:32:ca:8c:6d:32:91:40:97:e5:
+        a1:ad:22:7d:af:ab:ce:68:0b:69:52:53:8a:80:dd:f3:9f:a8:
+        1f:34:a7:1f:37:58:cb:6c:da:54:cf:cc:0b:67:95:e9:6e:30:
+        a4:ce:12:c4:5a:e0:d4:92:fb:0b:67:a8:51:ad:dc:4a:d0:ad:
+        fb:92:77:85:a5:9d:84:ff:99:50:ca:15:4f:d4:30:c8:85:ca:
+        95:a0:88:62
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUfENlx88n44OuL2CsA+XytiKIvKIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGU3lzdGVtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+oyEvdDTBG0GQtk5BcuA/nkmUVewCTN0UgLg9xsdHu6VZwzWGiRcIzv5x5i+cwdvS
+fhQk2mEwOuduseMhOIG8R9+yfx9gvj3F7XYDlOPEsz6/+EO6wlS8u2ZZmKP5quMQ
+6MOI3BoYb92Q62+jS9SvNFxDINVb55ilfHupFYa7KL+64Lv3HAjEJuvBrAUfdE8F
+EVfgEncXnondpTjuz89nvgxeakp0YSF5jsMo8eIGAC3qOm3ipiX9LYv1gjaRiiHw
+apMZ1nYI/c3ukKmpz5kwcUZX6vvFZU98hlyd17TDJzzrJ928VXYfJQ3Lb0Oan7re
+VMGQA57lDdnNhNRYdGO+WQIDAQABo4IBJDCCASAwHQYDVR0OBBYEFKD6tSRCcN/h
+u+YQYr7+9YETLzGbMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9TeXN0ZW1AdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AK0AQHo0rQfp7fqPH0gIeYGoPJDaBZV0BVGcF6hcAwnI+CwJZOJ8/GnhwF2K2fDz
+5M0sXkN3cfhYIIiPY+G0htt6VN/OvgHiVaJwqIlkzyoTeJHeg+3WdCQAyj1nSs3j
+grlWozq0gLKsYel1bDAcgZYv8Jmye3O1RbA8IO1Us4c3n14HxIpylFNOoqCDvPth
+Wf+MkRzbrXrgEuOjsZGX1MftAm5+AdjW1W2BojLKjG0ykUCX5aGtIn2vq85oC2lS
+U4qA3fOfqB80px83WMts2lTPzAtnleluMKTOEsRa4NSS+wtnqFGt3ErQrfuSd4Wl
+nYT/mVDKFU/UMMiFypWgiGI=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/System_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/System_cert.pem
new file mode 100644
index 00000000..33548531
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/System_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7c:43:65:c7:cf:27:e3:83:ae:2f:60:ac:03:e5:f2:b6:22:88:bc:a2
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=System
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a3:21:2f:74:34:c1:1b:41:90:b6:4e:41:72:e0:
+                    3f:9e:49:94:55:ec:02:4c:dd:14:80:b8:3d:c6:c7:
+                    47:bb:a5:59:c3:35:86:89:17:08:ce:fe:71:e6:2f:
+                    9c:c1:db:d2:7e:14:24:da:61:30:3a:e7:6e:b1:e3:
+                    21:38:81:bc:47:df:b2:7f:1f:60:be:3d:c5:ed:76:
+                    03:94:e3:c4:b3:3e:bf:f8:43:ba:c2:54:bc:bb:66:
+                    59:98:a3:f9:aa:e3:10:e8:c3:88:dc:1a:18:6f:dd:
+                    90:eb:6f:a3:4b:d4:af:34:5c:43:20:d5:5b:e7:98:
+                    a5:7c:7b:a9:15:86:bb:28:bf:ba:e0:bb:f7:1c:08:
+                    c4:26:eb:c1:ac:05:1f:74:4f:05:11:57:e0:12:77:
+                    17:9e:89:dd:a5:38:ee:cf:cf:67:be:0c:5e:6a:4a:
+                    74:61:21:79:8e:c3:28:f1:e2:06:00:2d:ea:3a:6d:
+                    e2:a6:25:fd:2d:8b:f5:82:36:91:8a:21:f0:6a:93:
+                    19:d6:76:08:fd:cd:ee:90:a9:a9:cf:99:30:71:46:
+                    57:ea:fb:c5:65:4f:7c:86:5c:9d:d7:b4:c3:27:3c:
+                    eb:27:dd:bc:55:76:1f:25:0d:cb:6f:43:9a:9f:ba:
+                    de:54:c1:90:03:9e:e5:0d:d9:cd:84:d4:58:74:63:
+                    be:59
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A0:FA:B5:24:42:70:DF:E1:BB:E6:10:62:BE:FE:F5:81:13:2F:31:9B
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:System@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        ad:00:40:7a:34:ad:07:e9:ed:fa:8f:1f:48:08:79:81:a8:3c:
+        90:da:05:95:74:05:51:9c:17:a8:5c:03:09:c8:f8:2c:09:64:
+        e2:7c:fc:69:e1:c0:5d:8a:d9:f0:f3:e4:cd:2c:5e:43:77:71:
+        f8:58:20:88:8f:63:e1:b4:86:db:7a:54:df:ce:be:01:e2:55:
+        a2:70:a8:89:64:cf:2a:13:78:91:de:83:ed:d6:74:24:00:ca:
+        3d:67:4a:cd:e3:82:b9:56:a3:3a:b4:80:b2:ac:61:e9:75:6c:
+        30:1c:81:96:2f:f0:99:b2:7b:73:b5:45:b0:3c:20:ed:54:b3:
+        87:37:9f:5e:07:c4:8a:72:94:53:4e:a2:a0:83:bc:fb:61:59:
+        ff:8c:91:1c:db:ad:7a:e0:12:e3:a3:b1:91:97:d4:c7:ed:02:
+        6e:7e:01:d8:d6:d5:6d:81:a2:32:ca:8c:6d:32:91:40:97:e5:
+        a1:ad:22:7d:af:ab:ce:68:0b:69:52:53:8a:80:dd:f3:9f:a8:
+        1f:34:a7:1f:37:58:cb:6c:da:54:cf:cc:0b:67:95:e9:6e:30:
+        a4:ce:12:c4:5a:e0:d4:92:fb:0b:67:a8:51:ad:dc:4a:d0:ad:
+        fb:92:77:85:a5:9d:84:ff:99:50:ca:15:4f:d4:30:c8:85:ca:
+        95:a0:88:62
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUfENlx88n44OuL2CsA+XytiKIvKIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGU3lzdGVtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+oyEvdDTBG0GQtk5BcuA/nkmUVewCTN0UgLg9xsdHu6VZwzWGiRcIzv5x5i+cwdvS
+fhQk2mEwOuduseMhOIG8R9+yfx9gvj3F7XYDlOPEsz6/+EO6wlS8u2ZZmKP5quMQ
+6MOI3BoYb92Q62+jS9SvNFxDINVb55ilfHupFYa7KL+64Lv3HAjEJuvBrAUfdE8F
+EVfgEncXnondpTjuz89nvgxeakp0YSF5jsMo8eIGAC3qOm3ipiX9LYv1gjaRiiHw
+apMZ1nYI/c3ukKmpz5kwcUZX6vvFZU98hlyd17TDJzzrJ928VXYfJQ3Lb0Oan7re
+VMGQA57lDdnNhNRYdGO+WQIDAQABo4IBJDCCASAwHQYDVR0OBBYEFKD6tSRCcN/h
+u+YQYr7+9YETLzGbMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9TeXN0ZW1AdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AK0AQHo0rQfp7fqPH0gIeYGoPJDaBZV0BVGcF6hcAwnI+CwJZOJ8/GnhwF2K2fDz
+5M0sXkN3cfhYIIiPY+G0htt6VN/OvgHiVaJwqIlkzyoTeJHeg+3WdCQAyj1nSs3j
+grlWozq0gLKsYel1bDAcgZYv8Jmye3O1RbA8IO1Us4c3n14HxIpylFNOoqCDvPth
+Wf+MkRzbrXrgEuOjsZGX1MftAm5+AdjW1W2BojLKjG0ykUCX5aGtIn2vq85oC2lS
+U4qA3fOfqB80px83WMts2lTPzAtnleluMKTOEsRa4NSS+wtnqFGt3ErQrfuSd4Wl
+nYT/mVDKFU/UMMiFypWgiGI=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem
new file mode 100644
index 00000000..a27daa1f
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5c:a1:af:d5:7c:bb:16:ef:c2:c7:e6:53:fc:94:1a:ed:24:bb:b4:17
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserA1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b4:eb:22:e2:c4:ba:7f:33:aa:57:ab:13:f1:69:
+                    09:98:28:3c:7d:a7:e2:41:2a:28:2f:f9:85:a1:6c:
+                    94:ee:0a:eb:4d:01:4c:28:7c:9d:05:4d:d8:10:7f:
+                    b7:cf:13:c2:a6:de:11:0c:97:38:97:cd:6d:11:fd:
+                    16:76:c0:eb:5a:b7:7b:17:13:45:9d:4b:00:4f:26:
+                    c5:b1:9b:67:93:2c:d6:d5:33:37:e1:50:1d:7b:0d:
+                    be:8c:cb:bd:29:99:8f:54:f6:7e:04:84:82:2a:28:
+                    ee:71:3e:8d:5f:72:b2:6a:77:6b:47:3e:ba:4d:b3:
+                    e2:96:14:71:0a:1e:26:16:8f:6c:1b:07:2a:ac:15:
+                    89:1e:88:63:c3:81:3b:91:e9:f3:43:1b:f0:ec:08:
+                    24:96:46:27:21:2a:56:25:2c:b6:cc:d9:02:70:77:
+                    9d:e4:7c:44:8c:93:04:85:a3:09:0a:8e:f5:e7:21:
+                    fa:bd:56:28:b7:52:20:09:ec:9a:c4:d4:d7:8a:19:
+                    4e:7a:10:e9:b2:10:36:68:ce:ce:78:8b:79:3f:6f:
+                    70:3b:75:6d:70:59:3a:c9:85:a8:f8:23:d4:ab:44:
+                    c2:ae:f5:1c:6e:38:11:e1:5f:cc:8f:e2:43:f5:b3:
+                    0e:09:17:b3:c6:ee:47:fb:39:c4:58:62:ba:e3:a8:
+                    c5:ef
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                70:55:CA:CA:A5:8F:4D:73:39:47:E2:97:A3:1F:F6:3E:33:C9:7A:BF
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:UserA1@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        99:81:61:3a:f1:c2:de:05:ad:ab:f3:fd:e0:d5:97:5b:fe:b2:
+        fa:e2:5f:ab:41:9d:71:1d:10:54:0b:bc:b5:c9:8d:26:91:a9:
+        45:71:51:14:61:a7:3c:ef:1d:f7:db:71:2f:1f:c1:d7:80:96:
+        03:5d:0d:69:81:fa:be:ca:f7:56:70:7b:89:ca:8f:b6:16:ee:
+        4a:83:fc:70:2e:4b:0c:50:ba:c6:06:5e:58:bb:25:d6:19:40:
+        82:b4:18:57:16:5f:f2:98:3e:5d:9d:72:7a:8f:20:de:25:c2:
+        06:a7:46:b2:cc:4c:f9:da:a7:43:f5:a0:92:e4:e2:05:49:43:
+        9d:58:9f:20:5d:e2:88:77:f1:10:0c:f5:fc:a2:85:b6:41:0a:
+        1a:12:75:1e:47:3b:b3:4f:c9:45:71:99:b6:14:e9:6b:7d:7a:
+        98:ee:82:dd:59:f6:af:fa:a5:d1:1c:24:db:66:e7:82:bb:53:
+        70:4f:27:96:dc:19:c0:9e:2d:df:da:00:2f:c3:22:9e:71:9c:
+        b3:89:da:0a:79:c3:f6:e3:9b:ca:b7:db:b6:5c:8f:e9:29:cb:
+        d0:9c:e3:0e:0f:7c:2c:b5:b0:36:a9:13:38:d2:8e:6f:6a:6c:
+        0a:7f:3f:dd:af:b1:e2:ea:c6:de:1d:b0:97:c9:36:1d:85:81:
+        aa:42:9f:53
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBcwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tOsi4sS6fzOqV6sT8WkJmCg8fafiQSooL/mFoWyU7grrTQFMKHydBU3YEH+3zxPC
+pt4RDJc4l81tEf0WdsDrWrd7FxNFnUsATybFsZtnkyzW1TM34VAdew2+jMu9KZmP
+VPZ+BISCKijucT6NX3KyandrRz66TbPilhRxCh4mFo9sGwcqrBWJHohjw4E7kenz
+Qxvw7AgklkYnISpWJSy2zNkCcHed5HxEjJMEhaMJCo715yH6vVYot1IgCeyaxNTX
+ihlOehDpshA2aM7OeIt5P29wO3VtcFk6yYWo+CPUq0TCrvUcbjgR4V/Mj+JD9bMO
+CRezxu5H+znEWGK646jF7wIDAQABo4IBJDCCASAwHQYDVR0OBBYEFHBVysqlj01z
+OUfil6Mf9j4zyXq/MB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQTFAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AJmBYTrxwt4Fravz/eDVl1v+svriX6tBnXEdEFQLvLXJjSaRqUVxURRhpzzvHffb
+cS8fwdeAlgNdDWmB+r7K91Zwe4nKj7YW7kqD/HAuSwxQusYGXli7JdYZQIK0GFcW
+X/KYPl2dcnqPIN4lwganRrLMTPnap0P1oJLk4gVJQ51YnyBd4oh38RAM9fyihbZB
+ChoSdR5HO7NPyUVxmbYU6Wt9epjugt1Z9q/6pdEcJNtm54K7U3BPJ5bcGcCeLd/a
+AC/DIp5xnLOJ2gp5w/bjm8q327Zcj+kpy9Cc4w4PfCy1sDapEzjSjm9qbAp/P92v
+seLqxt4dsJfJNh2FgapCn1M=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem
new file mode 100644
index 00000000..a2c5078b
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5c:a1:af:d5:7c:bb:16:ef:c2:c7:e6:53:fc:94:1a:ed:24:bb:b4:17
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserA1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b4:eb:22:e2:c4:ba:7f:33:aa:57:ab:13:f1:69:
+                    09:98:28:3c:7d:a7:e2:41:2a:28:2f:f9:85:a1:6c:
+                    94:ee:0a:eb:4d:01:4c:28:7c:9d:05:4d:d8:10:7f:
+                    b7:cf:13:c2:a6:de:11:0c:97:38:97:cd:6d:11:fd:
+                    16:76:c0:eb:5a:b7:7b:17:13:45:9d:4b:00:4f:26:
+                    c5:b1:9b:67:93:2c:d6:d5:33:37:e1:50:1d:7b:0d:
+                    be:8c:cb:bd:29:99:8f:54:f6:7e:04:84:82:2a:28:
+                    ee:71:3e:8d:5f:72:b2:6a:77:6b:47:3e:ba:4d:b3:
+                    e2:96:14:71:0a:1e:26:16:8f:6c:1b:07:2a:ac:15:
+                    89:1e:88:63:c3:81:3b:91:e9:f3:43:1b:f0:ec:08:
+                    24:96:46:27:21:2a:56:25:2c:b6:cc:d9:02:70:77:
+                    9d:e4:7c:44:8c:93:04:85:a3:09:0a:8e:f5:e7:21:
+                    fa:bd:56:28:b7:52:20:09:ec:9a:c4:d4:d7:8a:19:
+                    4e:7a:10:e9:b2:10:36:68:ce:ce:78:8b:79:3f:6f:
+                    70:3b:75:6d:70:59:3a:c9:85:a8:f8:23:d4:ab:44:
+                    c2:ae:f5:1c:6e:38:11:e1:5f:cc:8f:e2:43:f5:b3:
+                    0e:09:17:b3:c6:ee:47:fb:39:c4:58:62:ba:e3:a8:
+                    c5:ef
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                70:55:CA:CA:A5:8F:4D:73:39:47:E2:97:A3:1F:F6:3E:33:C9:7A:BF
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:UserA1@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        99:81:61:3a:f1:c2:de:05:ad:ab:f3:fd:e0:d5:97:5b:fe:b2:
+        fa:e2:5f:ab:41:9d:71:1d:10:54:0b:bc:b5:c9:8d:26:91:a9:
+        45:71:51:14:61:a7:3c:ef:1d:f7:db:71:2f:1f:c1:d7:80:96:
+        03:5d:0d:69:81:fa:be:ca:f7:56:70:7b:89:ca:8f:b6:16:ee:
+        4a:83:fc:70:2e:4b:0c:50:ba:c6:06:5e:58:bb:25:d6:19:40:
+        82:b4:18:57:16:5f:f2:98:3e:5d:9d:72:7a:8f:20:de:25:c2:
+        06:a7:46:b2:cc:4c:f9:da:a7:43:f5:a0:92:e4:e2:05:49:43:
+        9d:58:9f:20:5d:e2:88:77:f1:10:0c:f5:fc:a2:85:b6:41:0a:
+        1a:12:75:1e:47:3b:b3:4f:c9:45:71:99:b6:14:e9:6b:7d:7a:
+        98:ee:82:dd:59:f6:af:fa:a5:d1:1c:24:db:66:e7:82:bb:53:
+        70:4f:27:96:dc:19:c0:9e:2d:df:da:00:2f:c3:22:9e:71:9c:
+        b3:89:da:0a:79:c3:f6:e3:9b:ca:b7:db:b6:5c:8f:e9:29:cb:
+        d0:9c:e3:0e:0f:7c:2c:b5:b0:36:a9:13:38:d2:8e:6f:6a:6c:
+        0a:7f:3f:dd:af:b1:e2:ea:c6:de:1d:b0:97:c9:36:1d:85:81:
+        aa:42:9f:53
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBcwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tOsi4sS6fzOqV6sT8WkJmCg8fafiQSooL/mFoWyU7grrTQFMKHydBU3YEH+3zxPC
+pt4RDJc4l81tEf0WdsDrWrd7FxNFnUsATybFsZtnkyzW1TM34VAdew2+jMu9KZmP
+VPZ+BISCKijucT6NX3KyandrRz66TbPilhRxCh4mFo9sGwcqrBWJHohjw4E7kenz
+Qxvw7AgklkYnISpWJSy2zNkCcHed5HxEjJMEhaMJCo715yH6vVYot1IgCeyaxNTX
+ihlOehDpshA2aM7OeIt5P29wO3VtcFk6yYWo+CPUq0TCrvUcbjgR4V/Mj+JD9bMO
+CRezxu5H+znEWGK646jF7wIDAQABo4IBJDCCASAwHQYDVR0OBBYEFHBVysqlj01z
+OUfil6Mf9j4zyXq/MB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQTFAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AJmBYTrxwt4Fravz/eDVl1v+svriX6tBnXEdEFQLvLXJjSaRqUVxURRhpzzvHffb
+cS8fwdeAlgNdDWmB+r7K91Zwe4nKj7YW7kqD/HAuSwxQusYGXli7JdYZQIK0GFcW
+X/KYPl2dcnqPIN4lwganRrLMTPnap0P1oJLk4gVJQ51YnyBd4oh38RAM9fyihbZB
+ChoSdR5HO7NPyUVxmbYU6Wt9epjugt1Z9q/6pdEcJNtm54K7U3BPJ5bcGcCeLd/a
+AC/DIp5xnLOJ2gp5w/bjm8q327Zcj+kpy9Cc4w4PfCy1sDapEzjSjm9qbAp/P92v
+seLqxt4dsJfJNh2FgapCn1M=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_bundle.pem
new file mode 100644
index 00000000..a181550a
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7a:3d:fa:5b:9b:df:69:55:6e:9c:53:4c:fc:86:75:65:bc:78:4c:24
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserA2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a6:7c:40:80:2b:44:00:33:11:c6:c2:9d:67:3e:
+                    87:8e:7e:40:d3:f5:d3:27:b6:7d:18:3c:c0:86:ac:
+                    96:3a:ad:d8:c3:cb:ab:72:5e:4c:b7:24:45:da:c7:
+                    a8:cc:74:b8:21:75:62:9e:81:88:96:54:6e:db:f9:
+                    8c:2f:4c:97:0d:ce:21:42:2f:92:57:7f:34:2b:02:
+                    43:4c:22:ae:14:ca:fc:b2:2c:d0:67:0e:52:e0:6d:
+                    61:96:a6:3b:cc:4f:6a:d6:ef:45:9c:74:92:25:6c:
+                    0a:10:62:1b:22:2b:11:6b:d1:52:4d:da:8d:c3:4a:
+                    e6:74:a7:1b:1e:ef:8a:f4:96:88:02:0d:b7:57:35:
+                    9f:a3:ff:a2:2c:b7:0e:27:4e:79:2f:cf:0c:f1:91:
+                    0e:bf:01:d7:a2:71:2c:b7:0e:4b:7e:50:91:89:71:
+                    c2:17:aa:cb:29:80:9e:d7:2b:fa:33:41:e8:82:d1:
+                    3a:97:3d:6c:de:66:9b:b4:ea:1a:eb:94:be:6e:c0:
+                    66:e8:77:3d:72:d5:5c:a5:e8:ab:3b:33:f4:b3:c2:
+                    26:49:bc:08:55:cf:16:b6:12:22:91:fe:c1:5a:b2:
+                    d7:77:e3:f4:47:bc:c4:77:6b:f5:7f:c3:e8:48:99:
+                    b9:a8:ea:b1:ae:e6:cc:3a:12:fa:4d:2f:5f:0f:a8:
+                    fd:8d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B8:8E:4F:76:F1:F8:3C:A5:23:C5:8F:A1:2E:64:3E:48:53:02:CD:6B
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:UserA2@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        7c:1b:ae:98:16:42:f3:b2:a6:66:e9:a4:4f:61:04:a8:23:d5:
+        55:ea:d4:68:b5:98:fd:66:ff:10:dc:54:b7:01:78:4f:fc:e1:
+        75:e8:09:6d:ad:ac:57:b0:33:41:26:3d:ac:b0:17:46:c4:6f:
+        5b:c7:fa:ad:d2:94:13:ef:5e:bb:f5:ad:2d:39:85:d3:af:ff:
+        56:8e:f6:d1:20:12:03:86:cd:e8:ad:38:49:30:fb:98:de:3a:
+        5f:61:5a:08:37:a9:c3:10:ed:a3:60:3c:46:68:30:d8:4a:ac:
+        5d:eb:fd:d9:5d:90:b1:f0:b8:a8:68:5e:c8:41:6f:de:eb:a1:
+        cc:33:98:2d:06:17:26:c4:24:bf:62:82:a9:13:04:71:3e:6e:
+        ca:20:cf:5c:c5:47:67:f5:db:2e:56:60:4c:52:0c:4e:59:16:
+        da:6a:e3:b2:e4:cb:d6:65:26:df:26:2e:e0:f4:11:b1:36:92:
+        7c:ab:c3:c3:97:a5:06:26:54:5c:c1:35:a1:2f:e5:0f:2f:91:
+        2d:cd:c5:dd:a7:f2:4c:e1:4d:0d:5c:bd:25:4f:c8:52:79:c2:
+        29:78:ef:88:10:43:a4:c4:df:97:48:22:09:db:48:19:85:01:
+        48:39:28:20:69:1d:31:b5:4f:97:e0:ea:38:6d:e0:98:4b:78:
+        a4:b7:fd:c2
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUej36W5vfaVVunFNM/IZ1Zbx4TCQwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckEyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+pnxAgCtEADMRxsKdZz6Hjn5A0/XTJ7Z9GDzAhqyWOq3Yw8urcl5MtyRF2seozHS4
+IXVinoGIllRu2/mML0yXDc4hQi+SV380KwJDTCKuFMr8sizQZw5S4G1hlqY7zE9q
+1u9FnHSSJWwKEGIbIisRa9FSTdqNw0rmdKcbHu+K9JaIAg23VzWfo/+iLLcOJ055
+L88M8ZEOvwHXonEstw5LflCRiXHCF6rLKYCe1yv6M0HogtE6lz1s3mabtOoa65S+
+bsBm6Hc9ctVcpeirOzP0s8ImSbwIVc8WthIikf7BWrLXd+P0R7zEd2v1f8PoSJm5
+qOqxrubMOhL6TS9fD6j9jQIDAQABo4IBJDCCASAwHQYDVR0OBBYEFLiOT3bx+Dyl
+I8WPoS5kPkhTAs1rMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQTJAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AHwbrpgWQvOypmbppE9hBKgj1VXq1Gi1mP1m/xDcVLcBeE/84XXoCW2trFewM0Em
+PaywF0bEb1vH+q3SlBPvXrv1rS05hdOv/1aO9tEgEgOGzeitOEkw+5jeOl9hWgg3
+qcMQ7aNgPEZoMNhKrF3r/dldkLHwuKhoXshBb97rocwzmC0GFybEJL9igqkTBHE+
+bsogz1zFR2f12y5WYExSDE5ZFtpq47Lky9ZlJt8mLuD0EbE2knyrw8OXpQYmVFzB
+NaEv5Q8vkS3Nxd2n8kzhTQ1cvSVPyFJ5wil474gQQ6TE35dIIgnbSBmFAUg5KCBp
+HTG1T5fg6jht4JhLeKS3/cI=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_cert.pem
new file mode 100644
index 00000000..19b70a48
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/UserA2_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7a:3d:fa:5b:9b:df:69:55:6e:9c:53:4c:fc:86:75:65:bc:78:4c:24
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:37:36 2023 GMT
+            Not After : Apr 28 19:37:36 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserA2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a6:7c:40:80:2b:44:00:33:11:c6:c2:9d:67:3e:
+                    87:8e:7e:40:d3:f5:d3:27:b6:7d:18:3c:c0:86:ac:
+                    96:3a:ad:d8:c3:cb:ab:72:5e:4c:b7:24:45:da:c7:
+                    a8:cc:74:b8:21:75:62:9e:81:88:96:54:6e:db:f9:
+                    8c:2f:4c:97:0d:ce:21:42:2f:92:57:7f:34:2b:02:
+                    43:4c:22:ae:14:ca:fc:b2:2c:d0:67:0e:52:e0:6d:
+                    61:96:a6:3b:cc:4f:6a:d6:ef:45:9c:74:92:25:6c:
+                    0a:10:62:1b:22:2b:11:6b:d1:52:4d:da:8d:c3:4a:
+                    e6:74:a7:1b:1e:ef:8a:f4:96:88:02:0d:b7:57:35:
+                    9f:a3:ff:a2:2c:b7:0e:27:4e:79:2f:cf:0c:f1:91:
+                    0e:bf:01:d7:a2:71:2c:b7:0e:4b:7e:50:91:89:71:
+                    c2:17:aa:cb:29:80:9e:d7:2b:fa:33:41:e8:82:d1:
+                    3a:97:3d:6c:de:66:9b:b4:ea:1a:eb:94:be:6e:c0:
+                    66:e8:77:3d:72:d5:5c:a5:e8:ab:3b:33:f4:b3:c2:
+                    26:49:bc:08:55:cf:16:b6:12:22:91:fe:c1:5a:b2:
+                    d7:77:e3:f4:47:bc:c4:77:6b:f5:7f:c3:e8:48:99:
+                    b9:a8:ea:b1:ae:e6:cc:3a:12:fa:4d:2f:5f:0f:a8:
+                    fd:8d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B8:8E:4F:76:F1:F8:3C:A5:23:C5:8F:A1:2E:64:3E:48:53:02:CD:6B
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                email:UserA2@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        7c:1b:ae:98:16:42:f3:b2:a6:66:e9:a4:4f:61:04:a8:23:d5:
+        55:ea:d4:68:b5:98:fd:66:ff:10:dc:54:b7:01:78:4f:fc:e1:
+        75:e8:09:6d:ad:ac:57:b0:33:41:26:3d:ac:b0:17:46:c4:6f:
+        5b:c7:fa:ad:d2:94:13:ef:5e:bb:f5:ad:2d:39:85:d3:af:ff:
+        56:8e:f6:d1:20:12:03:86:cd:e8:ad:38:49:30:fb:98:de:3a:
+        5f:61:5a:08:37:a9:c3:10:ed:a3:60:3c:46:68:30:d8:4a:ac:
+        5d:eb:fd:d9:5d:90:b1:f0:b8:a8:68:5e:c8:41:6f:de:eb:a1:
+        cc:33:98:2d:06:17:26:c4:24:bf:62:82:a9:13:04:71:3e:6e:
+        ca:20:cf:5c:c5:47:67:f5:db:2e:56:60:4c:52:0c:4e:59:16:
+        da:6a:e3:b2:e4:cb:d6:65:26:df:26:2e:e0:f4:11:b1:36:92:
+        7c:ab:c3:c3:97:a5:06:26:54:5c:c1:35:a1:2f:e5:0f:2f:91:
+        2d:cd:c5:dd:a7:f2:4c:e1:4d:0d:5c:bd:25:4f:c8:52:79:c2:
+        29:78:ef:88:10:43:a4:c4:df:97:48:22:09:db:48:19:85:01:
+        48:39:28:20:69:1d:31:b5:4f:97:e0:ea:38:6d:e0:98:4b:78:
+        a4:b7:fd:c2
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUej36W5vfaVVunFNM/IZ1Zbx4TCQwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTM3MzZaFw0zMzA0MjgxOTM3MzZaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckEyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+pnxAgCtEADMRxsKdZz6Hjn5A0/XTJ7Z9GDzAhqyWOq3Yw8urcl5MtyRF2seozHS4
+IXVinoGIllRu2/mML0yXDc4hQi+SV380KwJDTCKuFMr8sizQZw5S4G1hlqY7zE9q
+1u9FnHSSJWwKEGIbIisRa9FSTdqNw0rmdKcbHu+K9JaIAg23VzWfo/+iLLcOJ055
+L88M8ZEOvwHXonEstw5LflCRiXHCF6rLKYCe1yv6M0HogtE6lz1s3mabtOoa65S+
+bsBm6Hc9ctVcpeirOzP0s8ImSbwIVc8WthIikf7BWrLXd+P0R7zEd2v1f8PoSJm5
+qOqxrubMOhL6TS9fD6j9jQIDAQABo4IBJDCCASAwHQYDVR0OBBYEFLiOT3bx+Dyl
+I8WPoS5kPkhTAs1rMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWYGo6dMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToxODg4OC9pbnRlcm1lZGlhdGUxX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjE4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQTJAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AHwbrpgWQvOypmbppE9hBKgj1VXq1Gi1mP1m/xDcVLcBeE/84XXoCW2trFewM0Em
+PaywF0bEb1vH+q3SlBPvXrv1rS05hdOv/1aO9tEgEgOGzeitOEkw+5jeOl9hWgg3
+qcMQ7aNgPEZoMNhKrF3r/dldkLHwuKhoXshBb97rocwzmC0GFybEJL9igqkTBHE+
+bsogz1zFR2f12y5WYExSDE5ZFtpq47Lky9ZlJt8mLuD0EbE2knyrw8OXpQYmVFzB
+NaEv5Q8vkS3Nxd2n8kzhTQ1cvSVPyFJ5wil474gQQ6TE35dIIgnbSBmFAUg5KCBp
+HTG1T5fg6jht4JhLeKS3/cI=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/certfile.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/certfile.pem
new file mode 100644
index 00000000..719d7516
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/certfile.pem
@@ -0,0 +1,175 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/private/System_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/private/System_keypair.pem
new file mode 100644
index 00000000..cc779bec
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/private/System_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCjIS90NMEbQZC2
+TkFy4D+eSZRV7AJM3RSAuD3Gx0e7pVnDNYaJFwjO/nHmL5zB29J+FCTaYTA6526x
+4yE4gbxH37J/H2C+PcXtdgOU48SzPr/4Q7rCVLy7ZlmYo/mq4xDow4jcGhhv3ZDr
+b6NL1K80XEMg1VvnmKV8e6kVhrsov7rgu/ccCMQm68GsBR90TwURV+ASdxeeid2l
+OO7Pz2e+DF5qSnRhIXmOwyjx4gYALeo6beKmJf0ti/WCNpGKIfBqkxnWdgj9ze6Q
+qanPmTBxRlfq+8VlT3yGXJ3XtMMnPOsn3bxVdh8lDctvQ5qfut5UwZADnuUN2c2E
+1Fh0Y75ZAgMBAAECggEAGJh8EGwU0pB56nbVmOW1Sd8jsanGNgMeYIMG83Xf+6uk
+Y1GqcXiK4DTOhQuYOcV0UQSmAtQlAriawNDzVRMAiaCxh8e6HSzwrws8YoJOCc2U
+AbFqkvrWQvYdW62bive1+LZkp/T6SsGQJGNebmRIr18a0vRAaWSjTOfTOFbqWKwD
+640JDw2KmJmba6JtOaEL4QWrvbugTNwh3OEHugBVTCiRTdruVpCpLSxW1yZEpwB2
+BmxQxHvbtIjiOmHuNrsh21jzi7IEx+TFawJ0EV6Wm9XCbjX62XETraILg5bWVGv7
+X+TIDE2JBCC9GZMm9Qj1EfCojRmKfxopv7sA1yBYRQKBgQC5K5NzQzk14G64tyvW
+61BteydWlBzFbgiMjYUq9wqgf2WbDVONBUB5x3MOArOmYuJOy0Xbt+pF3pF8wrkl
+hMt/hZqKzDtdDWo3+PnNFgcWmB+T76Jei9khIk3D9ENcGaNwGAS3l8sxqXNLVVBJ
+u5qHKeKFreXSra7xlXOuw5IMbQKBgQDhh1QqpQMloXOPCQWWzPtrEa8BRGNMFQTU
+yZFHeetQjjX5opxxMbbXU/wNz/dRgdfe2VLVo9e4dtQbzCKenuwWeivuDxd4YOsF
+Von9XDOzVWoXuP01MxDcU+sRoBLwWbpCWMe7r4Ny98C78+/5GssvkFUo+hd2vPo6
+U20pVZfuHQKBgGYD1eZooLpH/XgSojpzxgmrEc8nJnq21krpJPa4x8gIp+e2fdNx
+k0YEViTf5C3EyL10S/Zy6sS3jBvaA7rh4GNPLgdN4V6wp1ZS+vy8KAeQo8US/rds
+AKG6jnFovzucfGijMuYa4L1ph7V3ORaGHupcbwoK9lUNjxZVqjgcUvg5AoGBANOU
+zpWjcaxgJ7XNVP0BGe59DJ43tqCuJ3YqFK3l56oPgPvOXs6jQVIKbLHYpcJF+mwL
+nvbnW36nnJ7niKMfnYYI4CXa6r34zwSXB6Y2Vhqsy3euCX9bhTnvUN2cO6hZxbBw
+8hFWvA+j96FdXYlqZa0dz4c9+b1f1bHaitL4hizRAoGAVlH2lJr6s+ZmzkDY7D+Y
+6YKyjXaxhHBIqB2oLK1KuxGMiQnRADs9UOC4x2PQPOfemjVTJ3eN3rwxdqSh+Y2v
+K+RejHBJzbd4JIv0QRxpPAm9sezaNEHa7ss387cLZEBEYUI9HkIuPunKX+2lHITn
+WpVRyzYjVkFUUcRe3DyTlh8=
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem
new file mode 100644
index 00000000..1f4a6df1
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC06yLixLp/M6pX
+qxPxaQmYKDx9p+JBKigv+YWhbJTuCutNAUwofJ0FTdgQf7fPE8Km3hEMlziXzW0R
+/RZ2wOtat3sXE0WdSwBPJsWxm2eTLNbVMzfhUB17Db6My70pmY9U9n4EhIIqKO5x
+Po1fcrJqd2tHPrpNs+KWFHEKHiYWj2wbByqsFYkeiGPDgTuR6fNDG/DsCCSWRich
+KlYlLLbM2QJwd53kfESMkwSFowkKjvXnIfq9Vii3UiAJ7JrE1NeKGU56EOmyEDZo
+zs54i3k/b3A7dW1wWTrJhaj4I9SrRMKu9RxuOBHhX8yP4kP1sw4JF7PG7kf7OcRY
+YrrjqMXvAgMBAAECggEATFRQOaCKlpQzsB0rotSQCbQgIVutZ5Tjs6nwqTRoeS3+
+LFT5zrMUhGJdYEiiQimyHDjgtJEwfUtcUxSWX6/xHCsBMbEd08kK7loLWm2Ye02V
+rgmX7+WfKoWX+UsUGfMBt/TvIfTN/f+a6ghcGQMJJ0YO6tYaQCI+3NbvAjfKFgXi
+nWWZA+ipjh+Nu3YhVAy/uMInMi0qGWmpomU1yS+04E3OQksKYc3OmER7zFwbmNbF
+0LanWlLURUeHIS1BY+V4yXw6yBJaCDUpVA37mfLqRQshGtGjmWLtMt/AuSFokwHd
+yewoORlpVkZnE4Igv1JDggFdEI5lZ4PTmOjEXfntYQKBgQDH6sBr24OMUceNWyvf
+k03pqUaoiJkivAcUI/krfY7mdSLkiqs+UPuRrikGbvKT3R+iJVbTB4dXzGG6nzBc
+es7xwvzDGNHHXe0KAFhyIXwNMZmLGTmsNVfnKPAQ1BfKG9MtD5ck2gI1L1DkpaRz
+X57YONvG05HYmY7TaV2VOKK1iQKBgQDnq/zW6P9WHpIHBjZRN0V4yFl1dMfn2VwZ
+c3QWBd+kTwVBBhlJlqYeRIt4kmwExPnd3OX8Y7N18RttIc+k4dZgTA4w8G3xzvgk
+0sHgf3EBbrkUuS23BJ2IPIb4LmWckH6+KJkvBrlZOfoLBj8uxQwz/wmWA2IoQgKv
+CvDNr6G5twKBgECWSgZOjAhoX1T+0ITRvUkxJB/MydSb9JmAKb7wOJuh2l0Fo99l
+IHFnV9+5Nmuo89BZydwxwXsPD7/QMDqgfn1C5pBNU3Damnsxs2FkCgTlMlrrEmPd
+dAG9ixmUu/7S0H3tXIJOYIo4OCU2kpOnn9TxQafRsHvO2ILatp5ABukpAoGBALgP
+KJ4GF3bwaswx302/P+6qHoj28yv8wPNnir9Eg14jeeUjV0vj6K77fmOY0UEozeu6
+6O4QuC/oEwYtaq9wzcVMJ6oyGueWrAd1eptGJR4iPeF9DhjuDcqDbCgZlJlDI68o
+yitWiEOfkEzZ9bDO1NcqtQ7+OSoK597yLkb8Vt0ZAoGAN2dHPkTiNFlbzCefv/EP
+A4xQUAUiwfQ9ZlhMtD9Tlea8cMAD901rxy52YrgCvBPxw3HmKG2H0NOpa7BwrgA8
+uODxi6xBRExRhvaqZe1aP1xn4XKw2VVsMlIlJQj2Wmuxeknfm9R1sfRD797c4nuN
+ntLUOPAWtDkLoJLrTd9EqFk=
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA2_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA2_keypair.pem
new file mode 100644
index 00000000..8485c7cf
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client1/private/UserA2_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCmfECAK0QAMxHG
+wp1nPoeOfkDT9dMntn0YPMCGrJY6rdjDy6tyXky3JEXax6jMdLghdWKegYiWVG7b
++YwvTJcNziFCL5JXfzQrAkNMIq4UyvyyLNBnDlLgbWGWpjvMT2rW70WcdJIlbAoQ
+YhsiKxFr0VJN2o3DSuZ0pxse74r0logCDbdXNZ+j/6Istw4nTnkvzwzxkQ6/Adei
+cSy3Dkt+UJGJccIXqsspgJ7XK/ozQeiC0TqXPWzeZpu06hrrlL5uwGbodz1y1Vyl
+6Ks7M/SzwiZJvAhVzxa2EiKR/sFastd34/RHvMR3a/V/w+hImbmo6rGu5sw6EvpN
+L18PqP2NAgMBAAECggEAHsf4UPou326RydLvsUgRXhofuFDKEpyd8l5BJmVAfWbp
+HgJJF6Mxwea196ZUokCuTplae33tmAXSXV99OL2LbCUBZzBOeVjud0k60hfTYcrJ
+/9NjULqIPjBbC7R+d97zHPwuPagb4UlhbvgElkOqO+n+sqBG96WgiE7hJ84YPfJO
+Y+Is9vRbESkMVK1TH5PxfDE0Yu/i2vm/Fv+Ekgqe+GiZgbDw+L98D7ZX1xb8W2Ix
+WnM2Skd22pit1ftpixuHbdHcPX2NNdhFKy8r/ZYK0SCLwkb8yJhDLQF8Q01YXd6q
+FHtuE+MGXsr7dkcqYtc2QvigJdHs72WCjZwcpA+vgQKBgQC9qt3AIXPjPckhTEEK
+97tg0zqFVPHyhiy23qsKJ/egMIhYESQngLOPcQ0Q/bG5OJqe5sx31rmKQ368QUSX
+lIPG9WrRxCh3BTo7nOOEmAh4uGnKtvDJbTRP56fPQhkKlDywua8vKs0moUdcact7
+jjXYxXSPGEqHQrjPkuurPJvc7QKBgQDgtd4/kYGM9R2ltSLWm/TZnE6LM1EtBWrA
+HNAYV7WxxKdUvTtxBIXDKer0RAbDKHIoZ6HI3lon5siuBVtIFoq2VLxS1jm3rEJv
+qV6USxxDnEkbLla6Jzmd5eqFPZErWfNqmdXP1sqC8fs5q1PUJXNtEIdJulXQnHP2
+5lJxq8ovIQKBgQC1HBerg0YZ08HfHeVuB6jRiGH1N2vhXeYMqQtCI2/9ctp+3b9c
+STUs35LOirHOYBKlcVYFiPCa6mB2ewx4gcRjk61wqJLLNB6rFeDbmCFexRmgDJhY
+fwLY2igPbNpkk7BwQJ7bt082eAKgaBV54g3g9IucqGFiT4ASFgUb+kAK8QKBgFYJ
+rJgAWW8kJv7clQNA4YY0j+pCctFfIpl+LrszUhFHr54Fem3ygljQgvKV3VT59oO7
+8jkb0b83YR0oVeQLJX9cgGLjPWQzI5jna5wyChdlDqTGoFRUUn4/mwT7JstHfKkT
+T8dtgUqT5lIVZFp1IHXg/zveiZ7/WHNvip+VXCuhAoGAE3aA/rPBYEHJFLHaSgcR
+E+ggLP3HjQPN6347NXBZSaWSXqXtdLDlgnnysRnEd+JHSDI3lNuFa6d6nY7x7Mc0
+Bn54Tf3KLLHcyUrwQTCjY230212gYGqWXMgeaTPJRtl4K0PchWzKzZ1m9RQAZHOQ
+OaBsh0IA+LCDTmsPsbzh6U4=
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem
new file mode 100644
index 00000000..c09aef2d
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3a:d5:76:e0:a4:4b:67:ba:da:f2:9b:15:09:4c:ff:54:58:1d:e9:92
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:40:31 2023 GMT
+            Not After : Apr 28 19:40:31 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserB1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ba:19:65:ab:3f:2e:f2:7a:93:ea:06:eb:a2:9a:
+                    c5:b9:20:66:2e:74:1b:94:5a:43:1c:8c:22:72:00:
+                    79:2d:20:18:e3:4a:35:a6:df:8a:58:33:73:2c:28:
+                    20:e7:d9:85:ec:f5:81:ae:44:44:55:66:65:d6:b5:
+                    78:71:c4:d8:c2:7b:4c:2d:8b:18:b6:86:fc:50:c0:
+                    7e:b6:6e:f7:76:c0:30:6c:67:09:53:2d:87:98:d6:
+                    d4:d8:b3:a9:80:45:93:7f:33:3f:41:2a:70:f3:e1:
+                    df:a0:85:64:4b:25:e4:91:e9:e6:c8:c3:a0:3e:b3:
+                    ef:97:1f:ae:9d:44:84:35:26:26:4e:0c:7a:1d:c7:
+                    ef:b6:46:8d:82:b8:b0:18:fb:25:77:04:20:8c:da:
+                    af:fa:9e:a2:b0:67:b6:a6:5b:d7:95:a5:3c:3e:76:
+                    b4:37:4a:48:98:34:96:9d:d2:ff:36:6a:f4:2a:cd:
+                    85:b3:e3:71:74:0f:e0:25:f1:06:cb:9d:53:fc:b4:
+                    5d:c4:8d:7a:0b:bd:16:ee:5c:58:21:ad:49:34:9f:
+                    9e:1b:6d:f6:47:52:1f:a0:74:00:fe:3c:4d:5f:4c:
+                    5a:23:4a:d5:4c:ff:3f:42:5d:85:df:f6:3b:32:c4:
+                    ca:4b:d0:9d:4b:9e:86:a6:64:44:b8:ae:24:1a:f4:
+                    66:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                EC:AB:7B:4D:CD:62:D6:89:63:69:FE:97:34:5A:96:58:A5:94:A6:D9
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                email:UserB1@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        a8:78:fa:c2:44:e0:b9:c7:af:d5:cc:b6:b4:2b:3d:74:ae:b8:
+        d1:e1:22:d0:63:7d:77:97:db:97:2f:f1:f0:ce:e3:9e:5e:e1:
+        2a:19:54:00:38:7b:30:0b:8b:95:3a:4b:5d:83:08:80:fe:29:
+        85:72:fd:c9:80:6b:c3:fd:a3:00:4f:b5:f2:34:a3:42:54:77:
+        77:70:43:40:fe:1f:7a:b7:7f:55:c3:c0:e2:44:d1:95:fb:4c:
+        eb:f8:39:dd:b6:3d:07:27:39:8e:89:e4:a8:49:fd:02:70:65:
+        72:6f:c7:d4:12:57:bd:47:ea:7d:2d:63:b4:fe:81:33:20:3c:
+        e0:36:a2:60:58:79:5e:ce:6c:ed:7c:97:6e:6b:52:25:8d:73:
+        bb:ea:b5:8b:1e:d2:97:24:88:59:ea:a4:29:a3:ea:04:45:e1:
+        6a:cd:c8:b9:13:44:57:f8:7e:1a:85:34:11:71:f9:10:a4:6f:
+        07:d4:7d:21:84:f1:52:6f:f9:e8:36:83:28:32:aa:ad:2a:c3:
+        fb:98:02:c7:2e:2c:49:08:21:af:fe:15:0e:f3:ce:e7:24:b5:
+        c8:08:d6:20:e8:8c:24:ce:1f:84:0b:9a:46:07:8c:05:d0:86:
+        04:06:2b:a2:a8:e2:20:c1:1f:ac:07:fc:ac:e0:f5:ee:7a:c6:
+        5a:e4:81:74
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUOtV24KRLZ7ra8psVCUz/VFgd6ZIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTQwMzFaFw0zMzA0MjgxOTQwMzFaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+uhllqz8u8nqT6gbroprFuSBmLnQblFpDHIwicgB5LSAY40o1pt+KWDNzLCgg59mF
+7PWBrkREVWZl1rV4ccTYwntMLYsYtob8UMB+tm73dsAwbGcJUy2HmNbU2LOpgEWT
+fzM/QSpw8+HfoIVkSyXkkenmyMOgPrPvlx+unUSENSYmTgx6HcfvtkaNgriwGPsl
+dwQgjNqv+p6isGe2plvXlaU8Pna0N0pImDSWndL/Nmr0Ks2Fs+NxdA/gJfEGy51T
+/LRdxI16C70W7lxYIa1JNJ+eG232R1IfoHQA/jxNX0xaI0rVTP8/Ql2F3/Y7MsTK
+S9CdS56GpmREuK4kGvRmawIDAQABo4IBJDCCASAwHQYDVR0OBBYEFOyre03NYtaJ
+Y2n+lzRallillKbZMB8GA1UdIwQYMBaAFHVV4o7nraXdgD3JMwssold37RWsMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToyODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQjFAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AKh4+sJE4LnHr9XMtrQrPXSuuNHhItBjfXeX25cv8fDO455e4SoZVAA4ezALi5U6
+S12DCID+KYVy/cmAa8P9owBPtfI0o0JUd3dwQ0D+H3q3f1XDwOJE0ZX7TOv4Od22
+PQcnOY6J5KhJ/QJwZXJvx9QSV71H6n0tY7T+gTMgPOA2omBYeV7ObO18l25rUiWN
+c7vqtYse0pckiFnqpCmj6gRF4WrNyLkTRFf4fhqFNBFx+RCkbwfUfSGE8VJv+eg2
+gygyqq0qw/uYAscuLEkIIa/+FQ7zzucktcgI1iDojCTOH4QLmkYHjAXQhgQGK6Ko
+4iDBH6wH/Kzg9e56xlrkgXQ=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem
new file mode 100644
index 00000000..51050116
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3a:d5:76:e0:a4:4b:67:ba:da:f2:9b:15:09:4c:ff:54:58:1d:e9:92
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:40:31 2023 GMT
+            Not After : Apr 28 19:40:31 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserB1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ba:19:65:ab:3f:2e:f2:7a:93:ea:06:eb:a2:9a:
+                    c5:b9:20:66:2e:74:1b:94:5a:43:1c:8c:22:72:00:
+                    79:2d:20:18:e3:4a:35:a6:df:8a:58:33:73:2c:28:
+                    20:e7:d9:85:ec:f5:81:ae:44:44:55:66:65:d6:b5:
+                    78:71:c4:d8:c2:7b:4c:2d:8b:18:b6:86:fc:50:c0:
+                    7e:b6:6e:f7:76:c0:30:6c:67:09:53:2d:87:98:d6:
+                    d4:d8:b3:a9:80:45:93:7f:33:3f:41:2a:70:f3:e1:
+                    df:a0:85:64:4b:25:e4:91:e9:e6:c8:c3:a0:3e:b3:
+                    ef:97:1f:ae:9d:44:84:35:26:26:4e:0c:7a:1d:c7:
+                    ef:b6:46:8d:82:b8:b0:18:fb:25:77:04:20:8c:da:
+                    af:fa:9e:a2:b0:67:b6:a6:5b:d7:95:a5:3c:3e:76:
+                    b4:37:4a:48:98:34:96:9d:d2:ff:36:6a:f4:2a:cd:
+                    85:b3:e3:71:74:0f:e0:25:f1:06:cb:9d:53:fc:b4:
+                    5d:c4:8d:7a:0b:bd:16:ee:5c:58:21:ad:49:34:9f:
+                    9e:1b:6d:f6:47:52:1f:a0:74:00:fe:3c:4d:5f:4c:
+                    5a:23:4a:d5:4c:ff:3f:42:5d:85:df:f6:3b:32:c4:
+                    ca:4b:d0:9d:4b:9e:86:a6:64:44:b8:ae:24:1a:f4:
+                    66:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                EC:AB:7B:4D:CD:62:D6:89:63:69:FE:97:34:5A:96:58:A5:94:A6:D9
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                email:UserB1@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        a8:78:fa:c2:44:e0:b9:c7:af:d5:cc:b6:b4:2b:3d:74:ae:b8:
+        d1:e1:22:d0:63:7d:77:97:db:97:2f:f1:f0:ce:e3:9e:5e:e1:
+        2a:19:54:00:38:7b:30:0b:8b:95:3a:4b:5d:83:08:80:fe:29:
+        85:72:fd:c9:80:6b:c3:fd:a3:00:4f:b5:f2:34:a3:42:54:77:
+        77:70:43:40:fe:1f:7a:b7:7f:55:c3:c0:e2:44:d1:95:fb:4c:
+        eb:f8:39:dd:b6:3d:07:27:39:8e:89:e4:a8:49:fd:02:70:65:
+        72:6f:c7:d4:12:57:bd:47:ea:7d:2d:63:b4:fe:81:33:20:3c:
+        e0:36:a2:60:58:79:5e:ce:6c:ed:7c:97:6e:6b:52:25:8d:73:
+        bb:ea:b5:8b:1e:d2:97:24:88:59:ea:a4:29:a3:ea:04:45:e1:
+        6a:cd:c8:b9:13:44:57:f8:7e:1a:85:34:11:71:f9:10:a4:6f:
+        07:d4:7d:21:84:f1:52:6f:f9:e8:36:83:28:32:aa:ad:2a:c3:
+        fb:98:02:c7:2e:2c:49:08:21:af:fe:15:0e:f3:ce:e7:24:b5:
+        c8:08:d6:20:e8:8c:24:ce:1f:84:0b:9a:46:07:8c:05:d0:86:
+        04:06:2b:a2:a8:e2:20:c1:1f:ac:07:fc:ac:e0:f5:ee:7a:c6:
+        5a:e4:81:74
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUOtV24KRLZ7ra8psVCUz/VFgd6ZIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTQwMzFaFw0zMzA0MjgxOTQwMzFaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+uhllqz8u8nqT6gbroprFuSBmLnQblFpDHIwicgB5LSAY40o1pt+KWDNzLCgg59mF
+7PWBrkREVWZl1rV4ccTYwntMLYsYtob8UMB+tm73dsAwbGcJUy2HmNbU2LOpgEWT
+fzM/QSpw8+HfoIVkSyXkkenmyMOgPrPvlx+unUSENSYmTgx6HcfvtkaNgriwGPsl
+dwQgjNqv+p6isGe2plvXlaU8Pna0N0pImDSWndL/Nmr0Ks2Fs+NxdA/gJfEGy51T
+/LRdxI16C70W7lxYIa1JNJ+eG232R1IfoHQA/jxNX0xaI0rVTP8/Ql2F3/Y7MsTK
+S9CdS56GpmREuK4kGvRmawIDAQABo4IBJDCCASAwHQYDVR0OBBYEFOyre03NYtaJ
+Y2n+lzRallillKbZMB8GA1UdIwQYMBaAFHVV4o7nraXdgD3JMwssold37RWsMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToyODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQjFAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AKh4+sJE4LnHr9XMtrQrPXSuuNHhItBjfXeX25cv8fDO455e4SoZVAA4ezALi5U6
+S12DCID+KYVy/cmAa8P9owBPtfI0o0JUd3dwQ0D+H3q3f1XDwOJE0ZX7TOv4Od22
+PQcnOY6J5KhJ/QJwZXJvx9QSV71H6n0tY7T+gTMgPOA2omBYeV7ObO18l25rUiWN
+c7vqtYse0pckiFnqpCmj6gRF4WrNyLkTRFf4fhqFNBFx+RCkbwfUfSGE8VJv+eg2
+gygyqq0qw/uYAscuLEkIIa/+FQ7zzucktcgI1iDojCTOH4QLmkYHjAXQhgQGK6Ko
+4iDBH6wH/Kzg9e56xlrkgXQ=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_bundle.pem
new file mode 100644
index 00000000..b28ac13a
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            1e:dc:a2:b9:fd:aa:6e:73:ae:1c:7d:8d:13:73:d1:cd:16:bb:40:90
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:40:31 2023 GMT
+            Not After : Apr 28 19:40:31 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserB2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b2:1d:92:83:be:0f:40:5c:b8:34:93:66:28:ea:
+                    d3:85:1e:ec:66:e3:97:d0:fe:a7:2d:2c:89:c4:aa:
+                    e0:ff:62:a2:8b:19:19:8a:1f:bb:a9:24:2f:a8:a1:
+                    16:95:a7:5b:42:65:2f:03:27:12:ac:44:fb:2f:e0:
+                    9b:19:52:32:a7:db:83:d0:1a:d6:36:d7:b7:40:0e:
+                    85:c6:a7:75:5c:d1:71:a9:99:d3:da:2b:70:f9:9e:
+                    9d:0b:a8:35:bc:3c:7f:24:1e:b5:2e:83:31:07:c9:
+                    9b:4a:0e:a3:32:36:bd:a6:2c:55:79:f8:71:66:6a:
+                    2a:8f:f9:f9:67:b0:06:21:e4:2a:02:44:b6:39:84:
+                    18:7a:00:5e:34:36:f4:61:0d:11:a9:e2:0c:b8:05:
+                    ed:67:97:bc:29:e7:69:ac:48:6e:fb:78:e9:3b:38:
+                    e3:db:09:cb:22:0f:9a:57:1c:cc:06:f1:f7:44:66:
+                    d0:01:c4:c1:14:65:29:e5:cf:19:26:73:c9:8a:5c:
+                    2b:25:a9:d1:c6:3e:d8:4d:f5:f3:67:c7:23:b9:7b:
+                    2b:f5:97:28:89:81:99:9d:82:45:21:27:f4:ca:86:
+                    02:22:2f:26:4b:61:8a:cb:76:fb:b1:7b:4c:42:b6:
+                    25:e8:3e:cb:ab:2c:60:a7:a3:82:fb:ef:05:59:03:
+                    a5:5b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C6:25:DB:6C:4E:18:89:96:67:30:E8:5F:EC:0C:03:70:A4:4C:07:98
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                email:UserB2@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        7d:93:8d:17:4b:fe:9e:5d:d0:4e:c3:47:dc:6c:05:1b:10:7f:
+        9d:24:75:ea:30:27:c3:b1:26:2c:38:c3:c9:18:ec:21:d2:ef:
+        07:b2:d4:f9:2e:a1:a2:1a:a5:68:cb:1a:14:55:7f:82:05:8a:
+        a3:0d:11:f0:ed:f2:e2:c0:e3:6a:1c:76:42:01:92:68:2b:f7:
+        4d:98:ae:7b:02:f1:36:2e:44:67:43:39:8e:08:91:f1:f0:ab:
+        9c:84:df:08:80:bf:76:6b:37:3f:e8:70:e0:d6:27:73:e9:bc:
+        49:1f:c2:4a:15:51:22:c6:f3:85:52:e3:a6:93:aa:f6:c9:b4:
+        96:f2:09:e6:62:53:0e:87:76:fd:7a:38:69:e2:41:54:c5:51:
+        6e:cf:bc:1a:7b:0a:ef:c6:6e:be:b5:72:4d:f4:6f:fd:a5:a8:
+        ba:23:15:80:fa:b6:37:8d:68:d8:3e:36:c5:ae:f6:6c:22:a0:
+        00:0d:93:e1:ae:41:9a:d7:35:d0:ab:98:71:1b:6b:8d:da:78:
+        65:3c:97:be:9c:9e:d7:32:a1:0c:2b:60:ac:74:18:18:e4:48:
+        87:40:dd:bf:eb:0e:27:17:96:a1:aa:32:a9:58:b5:ee:fc:42:
+        7e:d7:71:a4:8e:a0:5b:06:6f:f1:85:27:8c:6b:20:df:e0:6b:
+        13:5f:cf:4c
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUHtyiuf2qbnOuHH2NE3PRzRa7QJAwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTQwMzFaFw0zMzA0MjgxOTQwMzFaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckIyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sh2Sg74PQFy4NJNmKOrThR7sZuOX0P6nLSyJxKrg/2KiixkZih+7qSQvqKEWladb
+QmUvAycSrET7L+CbGVIyp9uD0BrWNte3QA6Fxqd1XNFxqZnT2itw+Z6dC6g1vDx/
+JB61LoMxB8mbSg6jMja9pixVefhxZmoqj/n5Z7AGIeQqAkS2OYQYegBeNDb0YQ0R
+qeIMuAXtZ5e8KedprEhu+3jpOzjj2wnLIg+aVxzMBvH3RGbQAcTBFGUp5c8ZJnPJ
+ilwrJanRxj7YTfXzZ8cjuXsr9ZcoiYGZnYJFISf0yoYCIi8mS2GKy3b7sXtMQrYl
+6D7Lqyxgp6OC++8FWQOlWwIDAQABo4IBJDCCASAwHQYDVR0OBBYEFMYl22xOGImW
+ZzDoX+wMA3CkTAeYMB8GA1UdIwQYMBaAFHVV4o7nraXdgD3JMwssold37RWsMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToyODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQjJAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AH2TjRdL/p5d0E7DR9xsBRsQf50kdeowJ8OxJiw4w8kY7CHS7wey1PkuoaIapWjL
+GhRVf4IFiqMNEfDt8uLA42ocdkIBkmgr902YrnsC8TYuRGdDOY4IkfHwq5yE3wiA
+v3ZrNz/ocODWJ3PpvEkfwkoVUSLG84VS46aTqvbJtJbyCeZiUw6Hdv16OGniQVTF
+UW7PvBp7Cu/Gbr61ck30b/2lqLojFYD6tjeNaNg+NsWu9mwioAANk+GuQZrXNdCr
+mHEba43aeGU8l76cntcyoQwrYKx0GBjkSIdA3b/rDicXlqGqMqlYte78Qn7XcaSO
+oFsGb/GFJ4xrIN/gaxNfz0w=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_cert.pem
new file mode 100644
index 00000000..a76cdf8c
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/UserB2_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            1e:dc:a2:b9:fd:aa:6e:73:ae:1c:7d:8d:13:73:d1:cd:16:bb:40:90
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:40:31 2023 GMT
+            Not After : Apr 28 19:40:31 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=UserB2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b2:1d:92:83:be:0f:40:5c:b8:34:93:66:28:ea:
+                    d3:85:1e:ec:66:e3:97:d0:fe:a7:2d:2c:89:c4:aa:
+                    e0:ff:62:a2:8b:19:19:8a:1f:bb:a9:24:2f:a8:a1:
+                    16:95:a7:5b:42:65:2f:03:27:12:ac:44:fb:2f:e0:
+                    9b:19:52:32:a7:db:83:d0:1a:d6:36:d7:b7:40:0e:
+                    85:c6:a7:75:5c:d1:71:a9:99:d3:da:2b:70:f9:9e:
+                    9d:0b:a8:35:bc:3c:7f:24:1e:b5:2e:83:31:07:c9:
+                    9b:4a:0e:a3:32:36:bd:a6:2c:55:79:f8:71:66:6a:
+                    2a:8f:f9:f9:67:b0:06:21:e4:2a:02:44:b6:39:84:
+                    18:7a:00:5e:34:36:f4:61:0d:11:a9:e2:0c:b8:05:
+                    ed:67:97:bc:29:e7:69:ac:48:6e:fb:78:e9:3b:38:
+                    e3:db:09:cb:22:0f:9a:57:1c:cc:06:f1:f7:44:66:
+                    d0:01:c4:c1:14:65:29:e5:cf:19:26:73:c9:8a:5c:
+                    2b:25:a9:d1:c6:3e:d8:4d:f5:f3:67:c7:23:b9:7b:
+                    2b:f5:97:28:89:81:99:9d:82:45:21:27:f4:ca:86:
+                    02:22:2f:26:4b:61:8a:cb:76:fb:b1:7b:4c:42:b6:
+                    25:e8:3e:cb:ab:2c:60:a7:a3:82:fb:ef:05:59:03:
+                    a5:5b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C6:25:DB:6C:4E:18:89:96:67:30:E8:5F:EC:0C:03:70:A4:4C:07:98
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, E-mail Protection
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                email:UserB2@user.net
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        7d:93:8d:17:4b:fe:9e:5d:d0:4e:c3:47:dc:6c:05:1b:10:7f:
+        9d:24:75:ea:30:27:c3:b1:26:2c:38:c3:c9:18:ec:21:d2:ef:
+        07:b2:d4:f9:2e:a1:a2:1a:a5:68:cb:1a:14:55:7f:82:05:8a:
+        a3:0d:11:f0:ed:f2:e2:c0:e3:6a:1c:76:42:01:92:68:2b:f7:
+        4d:98:ae:7b:02:f1:36:2e:44:67:43:39:8e:08:91:f1:f0:ab:
+        9c:84:df:08:80:bf:76:6b:37:3f:e8:70:e0:d6:27:73:e9:bc:
+        49:1f:c2:4a:15:51:22:c6:f3:85:52:e3:a6:93:aa:f6:c9:b4:
+        96:f2:09:e6:62:53:0e:87:76:fd:7a:38:69:e2:41:54:c5:51:
+        6e:cf:bc:1a:7b:0a:ef:c6:6e:be:b5:72:4d:f4:6f:fd:a5:a8:
+        ba:23:15:80:fa:b6:37:8d:68:d8:3e:36:c5:ae:f6:6c:22:a0:
+        00:0d:93:e1:ae:41:9a:d7:35:d0:ab:98:71:1b:6b:8d:da:78:
+        65:3c:97:be:9c:9e:d7:32:a1:0c:2b:60:ac:74:18:18:e4:48:
+        87:40:dd:bf:eb:0e:27:17:96:a1:aa:32:a9:58:b5:ee:fc:42:
+        7e:d7:71:a4:8e:a0:5b:06:6f:f1:85:27:8c:6b:20:df:e0:6b:
+        13:5f:cf:4c
+-----BEGIN CERTIFICATE-----
+MIIEXTCCA0WgAwIBAgIUHtyiuf2qbnOuHH2NE3PRzRa7QJAwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTQwMzFaFw0zMzA0MjgxOTQwMzFaME8xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEP
+MA0GA1UEAwwGVXNlckIyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sh2Sg74PQFy4NJNmKOrThR7sZuOX0P6nLSyJxKrg/2KiixkZih+7qSQvqKEWladb
+QmUvAycSrET7L+CbGVIyp9uD0BrWNte3QA6Fxqd1XNFxqZnT2itw+Z6dC6g1vDx/
+JB61LoMxB8mbSg6jMja9pixVefhxZmoqj/n5Z7AGIeQqAkS2OYQYegBeNDb0YQ0R
+qeIMuAXtZ5e8KedprEhu+3jpOzjj2wnLIg+aVxzMBvH3RGbQAcTBFGUp5c8ZJnPJ
+ilwrJanRxj7YTfXzZ8cjuXsr9ZcoiYGZnYJFISf0yoYCIi8mS2GKy3b7sXtMQrYl
+6D7Lqyxgp6OC++8FWQOlWwIDAQABo4IBJDCCASAwHQYDVR0OBBYEFMYl22xOGImW
+ZzDoX+wMA3CkTAeYMB8GA1UdIwQYMBaAFHVV4o7nraXdgD3JMwssold37RWsMAwG
+A1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwIF4DAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwPQYDVR0fBDYwNDAyoDCgLoYs
+aHR0cDovLzEyNy4wLjAuMToyODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYI
+KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4
+LzAaBgNVHREEEzARgQ9Vc2VyQjJAdXNlci5uZXQwDQYJKoZIhvcNAQELBQADggEB
+AH2TjRdL/p5d0E7DR9xsBRsQf50kdeowJ8OxJiw4w8kY7CHS7wey1PkuoaIapWjL
+GhRVf4IFiqMNEfDt8uLA42ocdkIBkmgr902YrnsC8TYuRGdDOY4IkfHwq5yE3wiA
+v3ZrNz/ocODWJ3PpvEkfwkoVUSLG84VS46aTqvbJtJbyCeZiUw6Hdv16OGniQVTF
+UW7PvBp7Cu/Gbr61ck30b/2lqLojFYD6tjeNaNg+NsWu9mwioAANk+GuQZrXNdCr
+mHEba43aeGU8l76cntcyoQwrYKx0GBjkSIdA3b/rDicXlqGqMqlYte78Qn7XcaSO
+oFsGb/GFJ4xrIN/gaxNfz0w=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/certfile.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/certfile.pem
new file mode 100644
index 00000000..a25efa0b
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/certfile.pem
@@ -0,0 +1,175 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem
new file mode 100644
index 00000000..1b2df180
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC6GWWrPy7yepPq
+BuuimsW5IGYudBuUWkMcjCJyAHktIBjjSjWm34pYM3MsKCDn2YXs9YGuRERVZmXW
+tXhxxNjCe0wtixi2hvxQwH62bvd2wDBsZwlTLYeY1tTYs6mARZN/Mz9BKnDz4d+g
+hWRLJeSR6ebIw6A+s++XH66dRIQ1JiZODHodx++2Ro2CuLAY+yV3BCCM2q/6nqKw
+Z7amW9eVpTw+drQ3SkiYNJad0v82avQqzYWz43F0D+Al8QbLnVP8tF3EjXoLvRbu
+XFghrUk0n54bbfZHUh+gdAD+PE1fTFojStVM/z9CXYXf9jsyxMpL0J1LnoamZES4
+riQa9GZrAgMBAAECggEAAVnSLX+MajFnQj3our9FMrZSGx4bbAhQz9dndUWc1HT4
+d4AgPFpAfqpof6vVycHx2jSnILhuseJykSGzwoHgynrVpI82T6f9EzhRmkLbK1Y5
+6t6jC9uwXDvv37RgYcW02o1avD8VdHtN+qXtO4Db22P1p7zeA6LzSscmmLjf4QcY
+15O5DFUsVD6jfjI+edTKY4OgqblwD/t5EqApBI/KhAypSRD/NDzKdtHZO+K3eJW0
+apznw5wrzPVX1xk4p+1LnM5nLBRnwECqRyzlmxjX3rJr7tVVWqOkTHs807wK+7AW
+o9rujmS/J8I86BtZdj938VGVyuyqhJndANF8rOh6nQKBgQD09ZFmj/SMIeJIa2Xj
+MiK1JMU1rcr2h8NxYhQqZV/sj8TD+Sm/ljCDDClqyo5wAvBdIkFO689sIDEFT1W1
+vUOnE8xa4kkoSf4TVADiGAt4aLHiPiRAoX0aPqgBSy9IcXg7p/iG5qFLp72CNEFg
+3vM5vgjX+xio42Hqdo6+ruE1pwKBgQDCfK4KpR2BAv6dbuGNF8qZHWkgBDpSSlug
+WMEZe6c9l44EAIHgJNr4nBviVZTZAHD+H5qSC8STQ6Y4ccOZYnG4dGxAztKYnX9Z
+T6R+zOkisK+Zhq9noj8veBwS6F2fGTL7cagBkj2q3SveagGtutkV6kOKUw5uu8dI
+GnSxaiNpnQKBgQDrzURlVWgUST3ZdsECvq1YcIgCj0TUooYKLF67HREE2LSR7dU5
+XytdyyRHb6tDuiCFlscFYMwwCqEFuoQISaPJPq62QiQoS2nwUynyezD3fNjXr/gX
+2xxhWjVB4Y0nkEssKhp8SaC1AkjUANd6l8PNLti2iDkJwrDsEaqBdjjG+wKBgAVM
+Eg12K9SMuVSeZYRLRphfBbL6ioAdSFuYr0G7bXWvAA452U+6kUA+OEA05oX2jh1N
+zQ73RRZhvFBDQPmXhdNpUF1/hJrlh0dudOODP0JTn6TF11cyQxhO5CzbqVkg/ZN9
+p/7K9eUGeyBmsL8DnNAM/mPxGS6I7MeY+N6wLmC9AoGBAPL97OOwtkfCqCXBzIua
+eNFIPvW8cKEM1ggxUPGar36TuaKnDt8bdGL3/ZEAD28XMGCbUwo99WrW0J4r9b95
+Rrs1FzUW9iVIqB+4W35lMfSbFOC/2GsSUf95ANT4wihu2QbVQU7iqjXw+w8ZN9Vx
+Qkiwv6M/K0lzm6Q1H1pb7urx
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB2_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB2_keypair.pem
new file mode 100644
index 00000000..587c4544
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/client2/private/UserB2_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCyHZKDvg9AXLg0
+k2Yo6tOFHuxm45fQ/qctLInEquD/YqKLGRmKH7upJC+ooRaVp1tCZS8DJxKsRPsv
+4JsZUjKn24PQGtY217dADoXGp3Vc0XGpmdPaK3D5np0LqDW8PH8kHrUugzEHyZtK
+DqMyNr2mLFV5+HFmaiqP+flnsAYh5CoCRLY5hBh6AF40NvRhDRGp4gy4Be1nl7wp
+52msSG77eOk7OOPbCcsiD5pXHMwG8fdEZtABxMEUZSnlzxkmc8mKXCslqdHGPthN
+9fNnxyO5eyv1lyiJgZmdgkUhJ/TKhgIiLyZLYYrLdvuxe0xCtiXoPsurLGCno4L7
+7wVZA6VbAgMBAAECggEACzGbuulEMPd1DwetATtNZTbHBOoMe3vVj0A7dEiIXokG
+zc2tl10Td26EVEBFvTpI5YiaqwzElYNMTo2M7TjizvTynZyGusPnisl6SoWoh0U5
+2HWIAHkSKCAww1RbGL+HbEuO5Wy3R7FMC0C6PuQPP3Bo+swVnqn1s6wf88U/zWml
+Nthu0uQSj+pxW4tK/p7IoUVBnSqKExODDLG4LpO3meSaZIr36wC6bJZ8w8lZfRBy
+DkPJu9NNknL6qSoVGozLzgtg1//yCkU+LX0OcDgTNeup5DlA08jglQY8p3Xo3FPn
+evofoPvDnku4H1gCXT/djERRSlPdcGPEcy7xMQx12QKBgQDqdoL8hkp/DUzoKZyM
+u2Vud5E1jULal3SmRB1XFzqxEiFsAT6UBH2feVweBOKTjLBqIuC+teQ+JgC5TsYP
+CGbclQG/XBTYzOPfn3bBJWS4j7Jd68uXDQvkM9+RroFVaCXn75UGWEMqcbtgTNyU
+wUrAVgfTtz07iHf2oUy+IreW7wKBgQDCegdlOojhn4juC+B5ROJHXzwI1qEznpJa
+ftI7RERUbDFRIaucwvI6y95nduIRORO1bzpBhHZzJDPNBhZZya9wkaLElXktgi1Z
+IwF6eb3m/FtOxx7DtI9daCVsuZsoPEw08NJq6UYQqeauaJ3LM5rDSMX0DN3V//2m
+7tULbZn4VQKBgQCT4dwMWsdyC3mOlXBgc3IuksvL8yVPqmew1xWKcORb+wuJi99k
+jNCPXYR0irA+UGaVCxqmLyOe72lVeBIEOVBnoLRRdkrP06uGyJWmjWdR4ZCnHKp0
+w43UicNhp6d7rwz5lWtxbQowIzwEKXaXfLMhTSHyr4i3nAPOUz6MTmltkQKBgB6z
+ePtoFDfaIZnC0jsSvs4ZoLace3JUtDIJF1M34bmaIub188uZkvfpO0EGKYYihpP7
+7SxupuxiaLMTJPAjwMh6lUGHf0vJ4zLRLeiR04Llj9yN3rNyi7dpO49AddgSPM2W
+vwEVtnPm/n3GEjMEAIiXsnhml5azBO4XghZ9xPLJAoGBALctm1sK8MdawZ+cnc1i
+4P3VP2/nzGeODF29MbJefYrg0hlKHZSfKsWMKg3Dk9jDUplwsVjK5oBgN1vg/zOV
+ysTtyn1q/RBbe96lYkPHzdYPWDD5Rg80/t0n6jItTOQr6QCshDLrMB3bruIQz7V9
+6PPhzvdQu3v3e07wrKDa1F3t
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem
new file mode 100644
index 00000000..53786eb1
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem
@@ -0,0 +1,89 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/intermediate1/private/intermediate1_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/intermediate1/private/intermediate1_keypair.pem
new file mode 100644
index 00000000..6c04954d
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/intermediate1/private/intermediate1_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQC8xoQtwqtdBddl
+qOIVdNjy8VURRZOWTKXcy0T19BR+RgJZ6K54WWkhWPcWOLnCwmDYdquhOboLowMX
+5KHLXRoMYnEkZLAA8G9MrwhijNxP4NfUVSzbNvypqtdYJ+SZy9wp2eo1FssuvgSy
+glj05VwH2xKO4zyaXpBLxaPUIZZf4Y/3y57b4BCgbKIeMBdsMp97Q6Sf02szGxjN
+pK0zSKOYsCvIInQXcdjxZCFV4TO8f3Rfpaaim1gv2+3HweU2LoYmrcb+uACFbnzt
+/UrGoNmyP069+ghSyF0xE4a9P+x62DoV4nGv7ACIfqbo4Z2rV1qKH/jiTSlYU3kl
+8J7ZGEAnAgMBAAECgf9Now4nMXr/fdU8+hNvCMPnuMbV5ewWCN2bzEa04K1D09BI
+Tmm78MCVGwGoRoeNJBr5fdTPMMoJ/yVrG+W34iSvzqgnT4rJ/KqlA6CTwsiPyFay
+RgxRQHCpVuLwp8ClyQ0wu26XQlrgJ480trAoUQdj6pC3V+ICdk90R/j0RW5JtsSu
+e0ML3jNA9C4OgKlt2ia/MLqriaHXOf30EPONvtyqyKeGUFL7Un4eYKh4euRFEEMb
+MKngNonefDCIdYA1wVFa3wT8bNBbpuHl3ghkokv6VpdHIVn9wC1l6HY5nPRjgmo7
+sguRI1bRa2TFkOIVwZjCJTyfANyQw14pRS6rxIkCgYEAwzSYHRpJlPHAD7wi3tls
+bw7cBF9Q1P9PYKmVD9fAjx6eOjzDVOCdpGDijEkYoQoX1yYK3JaS8Vvp8V1wZ5Uh
+HTTr6Y5uS6CPh37wGTJc9XhXdJpeN67fEOBZGU04FUlASVFeCiV3Ga6YX0HQ/yKd
+VSc2JMX9mzxZjwhKRHmCEr0CgYEA95FFAxPxPNzYU3yHIdBlQWB1Z6AUFn+D4FgF
+xeFOGmul1E+0PnPH78IlYanMjhhJ1nkc6X71rdX4ylonB/x6ldUpghWW9VWrqRGG
+76S010aaZgOinwVE7+eeoelsIuma2W0QDwWrUT+RAsJBvZpGx1keo1qZEAaocs9V
+R2lvHrMCgYBNMTMl7wtB9wd4MXGoploW4M1ofTi9wehl1Sm5BhyDfBwd84FawygT
+pKxxxUYUCKW80rJg4Lpi73HnnIeirnpVzmOsDELZbTjU4AGaNSxFdb0/wvuXEXPs
+fIs/UiXnZPwjAiYp5P7gDQb8RE6dVdbZoZPrns/W31qbETAtO8+QEQKBgQDgA710
+yYjSz+uXr+j/OflFrSjPedRzfzMvv7aJlhP8aEgH049/q3jRhNYah3Enaub1gWYe
+Ctn4UNPtFqKW4WlzRw1mPm741Gqec9Or6VgSLDrt8IAocLYud2HdlMBa3xNVhxCu
+5yxcOq7W1jxyerVtEUFeA07ZZ4zpRp8eHVOFbQKBgGJGU7xoJWO9P17SUGNfmSEF
+6VIYFX6orA1Fi/kAJiqiFf98T4jnUWnL8LXVckt9FNw6KQqBCB6JuKXBFVkG2Bkr
+f5IIhziTuDVpdLQSf0Z2i59TspgYjiKs4WEN3N0HGtCXfbyPO6Tt08d4icxL5Myt
+W84T6Uof3+QQaqQnGvBE
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem
new file mode 100644
index 00000000..4ca1762a
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem
@@ -0,0 +1,89 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/intermediate2/private/intermediate2_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/intermediate2/private/intermediate2_keypair.pem
new file mode 100644
index 00000000..91e2908c
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/intermediate2/private/intermediate2_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaX/8d940anprz
+K2iPwQwzBkEAyT7kGuHgcGr1L63f8+mZ7cXXqpMTN/9HqvPFife3rTpH5ZxOn4zi
+Qe2kfJ2IMq71ioSfDBigs/6O3CqIavUvnIaS+ntus1p4Z1MLIWwNbIAaDh7uBsTS
+5yTG5XS+Hi4XVSvlnwugWMz+v1M399yViPR3plm0uHyiS7dqZ6qE3Cnx+deJBU0L
+84stUplX7W8Rnq8oo2FEwuxuf589C9z3GW0UiqW4tikCNJC0lsHLp0JGl8+NWf0X
+saYnp3uKR2/6AyQcEiXuNNZc2kWYIzDhSMma3zeqG3Bssg+VOdZtPiUgqAcsSFcM
+mVLLiQhBAgMBAAECggEABFew29ByrKMXSzsjgOpSmwgmjkSyPLiBIeSyZ85LK58u
+18oH62Y/tvvf1nXCk7zO4YbvGANrpI+dLlmnx2PYAR+a5ZSb1wrXSYjSyNX9fYl8
+9zWqYm1bO4QTCj5pwximzKyJ7pq1yD93tgb1LwRcmjRA7+NYdGBBi66AYxd8aOo6
+QB7JoME+hzYAWB+foCOAPGAxYe7EFCPkPEyz08oxRCvDua0xa0+tWkU77MhUSCu+
+/uSq/Og9C9TfzCX0W91TNDnq8VeXbLDJoPNzgfSWIeYxSw/X5dUkYU8N2LuPLQOO
+84Xv5UqU9YV22TEjg22YAL8/GMZ160K1xzXnQb1LPQKBgQDs/jOBp9NFiFlcNbJ8
+MKdfv+sktQR7onGehOaz/dEFEKiHNO8UmSlkAk+aZoTmYXKgIT4uytKRSOfZUWSl
+kY64sKJ7KTvVq/Dzm4KsyH8VgYYQ3OrNbqSCSK7DiOiKJxQ+Jhm2+a+io16B8ZbM
+RXLoaQ5+8oET6BgM5R6IMe4iFQKBgQDr44q7I7nhQdNz4h7OJ4HZ8X8WmQG7YpSX
+EMLb5sX5wymfPi5uUDTcthUw7dpleO9js5iT93fB6+rd5yyiDPIes/dWjqULprvR
+zIIr0u+cyt1TRxrNSa6dz/dJO3t/g/fTPKeM9j7ON4RvEGW4LPA+PbEUU0Q6xfSq
+OZ0sZSXUfQKBgQDh8+r/rxbLsJgiRkAKEAlETSLQOJYxmkthq6yZ52ElxyAm6N0Z
+cn34EAv9VclYLYiwC4HR8yaXxj7m/6dKBGFizWXcrw+RRQHSAW6xdedUhc1gvoBP
+pTHL1ahqXVn4fhHav1C9F4nRMpmkosX3tC8+Twu3FVbjt+FWSgy2JYS5kQKBgD5B
+6u6jaj7Skc2HA5xjfvkXrPQ44+UiCpeoW9WQHfZilQyra7O/xYPvJr6oODkJ5xzI
+XN/Is7nh2zY/+l62zfxegUw+D794fR/NOxn37TfTrwB4xtEhvk12gwy3/0tTeEgv
+PQWORFtG+dQaXs5yReIXhDIaG+rrLjzzQdFizM49AoGBAOulUGVDBpUFDVJn8S5r
+bqss/PXW+5xj5g8b9/tzBuyfL0NJ9p3q6EWlELPRTX3zXuVRYjSe9cBUm5FXPxP2
+s1TsGUILjSw21dOtodahvXRDN3Uw2ALQy1MTDy8xLhr9Le+e6xF1T2muzg0vDT6L
+VXAYfY5NPUOiPaYAj792oZk/
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem
new file mode 100644
index 00000000..760eb22e
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem
@@ -0,0 +1,181 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            29:e1:52:8d:fd:a5:2a:87:eb:1d:e4:1d:47:6c:e1:8a:58:69:73:ab
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:28:39 2023 GMT
+            Not After : Apr 28 19:28:39 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=OCSP Responder
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a3:0c:ca:eb:80:eb:a1:0e:1e:71:9b:d3:b3:f9:
+                    65:ce:70:c2:21:06:3c:31:c1:06:7e:a5:a8:4a:e1:
+                    21:a3:74:54:9f:57:ce:50:d6:c3:29:3c:43:b0:9d:
+                    3e:54:94:ee:8d:fa:0d:71:6c:df:5e:9e:01:30:79:
+                    6c:bb:97:5d:af:bb:5b:05:77:72:9f:55:e6:66:45:
+                    f4:e2:c2:cf:7b:0e:58:d6:14:6a:76:29:ac:e3:30:
+                    28:0d:ee:bd:ca:aa:ae:1f:1e:ef:40:f3:c3:ab:17:
+                    f2:d7:ec:0d:e1:fb:68:9a:09:83:99:11:58:42:94:
+                    f8:0d:d4:9a:6f:9f:3b:e8:56:f0:a9:b7:18:1a:91:
+                    41:7c:43:e3:db:b1:01:f1:ad:0b:39:d7:65:98:e6:
+                    15:b0:17:a9:56:6e:fb:84:7a:c0:cc:67:75:fc:f6:
+                    75:84:31:78:c5:6d:51:8f:d0:19:d3:16:4f:87:ef:
+                    5b:33:b9:7a:dd:fe:5f:a8:6a:fd:44:54:00:f3:a4:
+                    a6:5b:fd:3b:65:38:4f:82:4f:b9:c4:bd:c9:9a:56:
+                    fc:54:f1:58:2f:cb:ee:f4:08:fd:b7:ec:ad:28:08:
+                    66:9b:f8:78:98:32:db:b1:56:dd:0e:31:ba:c6:e3:
+                    56:f5:02:2f:fb:76:28:bb:c4:8b:f3:6b:da:aa:1d:
+                    38:21
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                CB:5E:50:60:7A:AB:2F:A9:3B:1E:24:AB:02:42:8D:EC:81:60:48:13
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                OCSP Signing
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        48:65:ce:6d:91:46:30:37:b6:f2:76:c0:42:e3:f5:ee:e9:32:
+        0e:46:b5:d5:9d:ac:b0:f2:23:f5:35:a8:1c:61:66:81:c0:0d:
+        bc:a4:bb:b5:be:47:58:8b:f1:d1:5f:73:83:d2:99:da:3e:a3:
+        0b:32:81:96:a4:bd:a8:57:8e:fe:3d:c4:93:57:ef:05:77:60:
+        c9:88:1c:2e:25:7e:ea:c8:95:8d:a6:4a:73:e5:bb:6c:c4:3b:
+        01:03:90:8d:12:f5:69:13:c5:79:87:ae:45:cb:49:c8:90:24:
+        39:30:cf:27:ba:31:1e:5f:5b:e0:0f:93:82:66:28:33:dc:e3:
+        a1:a8:fc:ad:40:d0:48:31:63:fb:a0:6a:13:18:b1:8b:59:bb:
+        ef:96:f8:83:98:6c:4a:18:37:1a:02:ad:c2:42:1d:7e:1c:dc:
+        4a:77:b7:f5:ae:97:3e:17:e8:35:96:85:a0:e4:30:c5:03:0b:
+        62:55:13:c1:3f:df:15:1b:c3:45:f7:69:d6:5e:f5:77:fc:4f:
+        e8:28:3b:3e:f0:2c:20:22:81:72:a3:d6:1b:d1:52:63:86:21:
+        22:06:7a:5b:f4:2a:c7:e5:b9:97:ac:1b:56:b5:4c:62:e9:f9:
+        6f:49:5f:43:3d:9c:e6:85:3a:f8:c9:4c:33:fd:e9:aa:88:8e:
+        cf:28:5c:69
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIUKeFSjf2lKofrHeQdR2zhilhpc6swDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTI4MzlaFw0zMzA0MjgxOTI4MzlaMFcxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEX
+MBUGA1UEAwwOT0NTUCBSZXNwb25kZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCjDMrrgOuhDh5xm9Oz+WXOcMIhBjwxwQZ+pahK4SGjdFSfV85Q1sMp
+PEOwnT5UlO6N+g1xbN9engEweWy7l12vu1sFd3KfVeZmRfTiws97DljWFGp2Kazj
+MCgN7r3Kqq4fHu9A88OrF/LX7A3h+2iaCYOZEVhClPgN1JpvnzvoVvCptxgakUF8
+Q+PbsQHxrQs512WY5hWwF6lWbvuEesDMZ3X89nWEMXjFbVGP0BnTFk+H71szuXrd
+/l+oav1EVADzpKZb/TtlOE+CT7nEvcmaVvxU8Vgvy+70CP237K0oCGab+HiYMtux
+Vt0OMbrG41b1Ai/7dii7xIvza9qqHTghAgMBAAGjge0wgeowHQYDVR0OBBYEFMte
+UGB6qy+pOx4kqwJCjeyBYEgTMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWY
+Go6dMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoG
+CCsGAQUFBwMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4
+ODgvaW50ZXJtZWRpYXRlMV9jcmwuZGVyMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEF
+BQcwAYYXaHR0cDovLzEyNy4wLjAuMToxODg4OC8wDQYJKoZIhvcNAQELBQADggEB
+AEhlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFf
+c4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S
+9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZ
+u++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3
+adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9
+nOaFOvjJTDP96aqIjs8oXGk=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_cert.pem
new file mode 100644
index 00000000..218a28e9
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_cert.pem
@@ -0,0 +1,92 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            29:e1:52:8d:fd:a5:2a:87:eb:1d:e4:1d:47:6c:e1:8a:58:69:73:ab
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:28:39 2023 GMT
+            Not After : Apr 28 19:28:39 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=OCSP Responder
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a3:0c:ca:eb:80:eb:a1:0e:1e:71:9b:d3:b3:f9:
+                    65:ce:70:c2:21:06:3c:31:c1:06:7e:a5:a8:4a:e1:
+                    21:a3:74:54:9f:57:ce:50:d6:c3:29:3c:43:b0:9d:
+                    3e:54:94:ee:8d:fa:0d:71:6c:df:5e:9e:01:30:79:
+                    6c:bb:97:5d:af:bb:5b:05:77:72:9f:55:e6:66:45:
+                    f4:e2:c2:cf:7b:0e:58:d6:14:6a:76:29:ac:e3:30:
+                    28:0d:ee:bd:ca:aa:ae:1f:1e:ef:40:f3:c3:ab:17:
+                    f2:d7:ec:0d:e1:fb:68:9a:09:83:99:11:58:42:94:
+                    f8:0d:d4:9a:6f:9f:3b:e8:56:f0:a9:b7:18:1a:91:
+                    41:7c:43:e3:db:b1:01:f1:ad:0b:39:d7:65:98:e6:
+                    15:b0:17:a9:56:6e:fb:84:7a:c0:cc:67:75:fc:f6:
+                    75:84:31:78:c5:6d:51:8f:d0:19:d3:16:4f:87:ef:
+                    5b:33:b9:7a:dd:fe:5f:a8:6a:fd:44:54:00:f3:a4:
+                    a6:5b:fd:3b:65:38:4f:82:4f:b9:c4:bd:c9:9a:56:
+                    fc:54:f1:58:2f:cb:ee:f4:08:fd:b7:ec:ad:28:08:
+                    66:9b:f8:78:98:32:db:b1:56:dd:0e:31:ba:c6:e3:
+                    56:f5:02:2f:fb:76:28:bb:c4:8b:f3:6b:da:aa:1d:
+                    38:21
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                CB:5E:50:60:7A:AB:2F:A9:3B:1E:24:AB:02:42:8D:EC:81:60:48:13
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                OCSP Signing
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        48:65:ce:6d:91:46:30:37:b6:f2:76:c0:42:e3:f5:ee:e9:32:
+        0e:46:b5:d5:9d:ac:b0:f2:23:f5:35:a8:1c:61:66:81:c0:0d:
+        bc:a4:bb:b5:be:47:58:8b:f1:d1:5f:73:83:d2:99:da:3e:a3:
+        0b:32:81:96:a4:bd:a8:57:8e:fe:3d:c4:93:57:ef:05:77:60:
+        c9:88:1c:2e:25:7e:ea:c8:95:8d:a6:4a:73:e5:bb:6c:c4:3b:
+        01:03:90:8d:12:f5:69:13:c5:79:87:ae:45:cb:49:c8:90:24:
+        39:30:cf:27:ba:31:1e:5f:5b:e0:0f:93:82:66:28:33:dc:e3:
+        a1:a8:fc:ad:40:d0:48:31:63:fb:a0:6a:13:18:b1:8b:59:bb:
+        ef:96:f8:83:98:6c:4a:18:37:1a:02:ad:c2:42:1d:7e:1c:dc:
+        4a:77:b7:f5:ae:97:3e:17:e8:35:96:85:a0:e4:30:c5:03:0b:
+        62:55:13:c1:3f:df:15:1b:c3:45:f7:69:d6:5e:f5:77:fc:4f:
+        e8:28:3b:3e:f0:2c:20:22:81:72:a3:d6:1b:d1:52:63:86:21:
+        22:06:7a:5b:f4:2a:c7:e5:b9:97:ac:1b:56:b5:4c:62:e9:f9:
+        6f:49:5f:43:3d:9c:e6:85:3a:f8:c9:4c:33:fd:e9:aa:88:8e:
+        cf:28:5c:69
+-----BEGIN CERTIFICATE-----
+MIIELTCCAxWgAwIBAgIUKeFSjf2lKofrHeQdR2zhilhpc6swDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTI4MzlaFw0zMzA0MjgxOTI4MzlaMFcxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEX
+MBUGA1UEAwwOT0NTUCBSZXNwb25kZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCjDMrrgOuhDh5xm9Oz+WXOcMIhBjwxwQZ+pahK4SGjdFSfV85Q1sMp
+PEOwnT5UlO6N+g1xbN9engEweWy7l12vu1sFd3KfVeZmRfTiws97DljWFGp2Kazj
+MCgN7r3Kqq4fHu9A88OrF/LX7A3h+2iaCYOZEVhClPgN1JpvnzvoVvCptxgakUF8
+Q+PbsQHxrQs512WY5hWwF6lWbvuEesDMZ3X89nWEMXjFbVGP0BnTFk+H71szuXrd
+/l+oav1EVADzpKZb/TtlOE+CT7nEvcmaVvxU8Vgvy+70CP237K0oCGab+HiYMtux
+Vt0OMbrG41b1Ai/7dii7xIvza9qqHTghAgMBAAGjge0wgeowHQYDVR0OBBYEFMte
+UGB6qy+pOx4kqwJCjeyBYEgTMB8GA1UdIwQYMBaAFLWRbk9ktxaEdvm0vpnOYJWY
+Go6dMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoG
+CCsGAQUFBwMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4
+ODgvaW50ZXJtZWRpYXRlMV9jcmwuZGVyMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEF
+BQcwAYYXaHR0cDovLzEyNy4wLjAuMToxODg4OC8wDQYJKoZIhvcNAQELBQADggEB
+AEhlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFf
+c4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S
+9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZ
+u++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3
+adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9
+nOaFOvjJTDP96aqIjs8oXGk=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem
new file mode 100644
index 00000000..13b6dbe9
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCjDMrrgOuhDh5x
+m9Oz+WXOcMIhBjwxwQZ+pahK4SGjdFSfV85Q1sMpPEOwnT5UlO6N+g1xbN9engEw
+eWy7l12vu1sFd3KfVeZmRfTiws97DljWFGp2KazjMCgN7r3Kqq4fHu9A88OrF/LX
+7A3h+2iaCYOZEVhClPgN1JpvnzvoVvCptxgakUF8Q+PbsQHxrQs512WY5hWwF6lW
+bvuEesDMZ3X89nWEMXjFbVGP0BnTFk+H71szuXrd/l+oav1EVADzpKZb/TtlOE+C
+T7nEvcmaVvxU8Vgvy+70CP237K0oCGab+HiYMtuxVt0OMbrG41b1Ai/7dii7xIvz
+a9qqHTghAgMBAAECggEAE++sPxPuG6zzhX4hakvYCiAo6GtQAGBi6CjetTsmRwti
+DnKoyCMeTUQwXZ+4X5SvP35f1urSPAozSIdMR3qoSqSsqjQy+G8DIyWyHejmgBwe
+uhxYcRbC7Ct29k8m9ykb7bO1WtqDZf/hYkvbXbKFFXKM2/IuOcPnuZ8xe+z7IPsQ
+ODHnrQs45wQyi2i2/+AbvEJjb3bb3oS8MfoZfvO8F06ejTOmv/ATZSxX0T6ppCPj
+HdmKqKDXlYQNA/LQeM4cs2FaQH170R1vGHppDjcs2ezqElB7/HKfKWeEn0Eytu9E
+eWw9tZteisnzfqEvDMgOM2eWwAzfIhXSQYMWlVBicQKBgQC6MPaLd4r82BBMj7qx
+ChdBxB7LXptvx/q3SrMjZ6GKmrGdXMbsos50XexajktBqkXfUMa8hGqmlciN5xL1
++w//p7oSzb3VorOyHVXZpc8p79eUeX8ONcwySOYwO+CpqFBBDlvPn1OuPnlUL1pv
+IgCMT66flWJxRklDMIJsHr+iWQKBgQDgLq3I2cj4q+3121ECPXKLt+VCHUY0aygc
+tl6lvQw61UnmyLQ+k53/MmyPGGCxIFr18DsoKeWYwt3kWTW0MCDrQuO6PZkB268v
+gdsmN3nhAKiR0gUwJDrFjpPWr0GAhw9LE7HqpvkQ3fG5YSnXTUibhm6smHg7dzVL
+ER+QJ+Y7CQKBgHIDN4WRjy9jEx/+x0BPwIwKDx1TcnURjQoeGPHuLHJWZbrJrBoN
+W8TQGsIc7iJopN6pdPjNUQ1vHN8gB3FO6q4PRBbtm3gtaEICSqa7LM8uSeFmQJIw
+CTklgKc6k0jwgyxDIZ9SnghNwzf0wzjYJmPFC1Y3QI/CjWwyUTrp3UkJAoGBANHc
+IKcS6MWQ/RPYGP+F0kLlBWJc0Smk3knylquES3yPybyXSdQCkDcjVuilo25soXn1
+RwuUHPBiCyIGOPXS0B4r4c6odyF8K4THhQVDjX6KBUNsXZrxb2scy1x/d0wAItrf
+NwA5CpM1kWE+idKY8E1XDSfZG0Rfla4N+4QRNb8xAoGAQrVe80TpPpzDH846xaPF
+BAhjKz7dRrUQ1n7ZI6yw8I5bU2ky9jSF3PRsDismM23aNbYhIgjcYv0tG0LMlWLV
+2eIrU9OoA7aepDPozyhEkENaWqYXX/T8AjD+Kaw7XJnt/NX8eS0RF2qgDA/HEwWw
+uf1ecRqpjZ9cxNGLZ+/pOkM=
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem
new file mode 100644
index 00000000..2d3f2d02
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem
@@ -0,0 +1,181 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7b:97:35:73:2b:2b:5f:74:c6:43:83:8f:ae:65:5b:a0:f5:f4:ff:1f
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:29:28 2023 GMT
+            Not After : Apr 28 19:29:28 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=OCSP Responder 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:98:3d:03:4d:5e:b2:66:5e:51:3b:f9:3d:f2:
+                    7a:24:6b:70:5c:2f:7a:05:b2:51:77:62:45:e7:33:
+                    75:77:db:31:6f:2d:13:32:cd:d3:a0:03:84:ee:f9:
+                    2b:81:9d:e5:c9:ba:e2:25:c9:a7:18:2b:fd:f1:95:
+                    ad:d3:46:90:d9:7b:7f:39:2d:85:b4:70:7c:72:44:
+                    99:fb:df:9f:22:4c:81:77:35:bb:fe:41:7f:86:f5:
+                    c7:29:53:7c:ee:d4:cc:09:54:fa:cc:b1:4d:4b:c2:
+                    c7:c7:3e:1a:13:59:66:36:31:ae:60:1b:6a:05:b0:
+                    5b:64:96:77:9d:74:cc:42:6e:13:d1:21:83:94:8e:
+                    6c:4c:d8:42:57:94:17:ff:26:d4:d1:2f:64:58:b5:
+                    47:1a:22:38:69:bf:c0:5a:9c:c3:88:01:0a:1d:f7:
+                    d8:68:88:7c:57:5d:44:c4:71:d0:66:8d:1c:39:e0:
+                    af:e8:f7:ce:51:60:7c:1d:b7:d5:e7:b5:3e:6a:a5:
+                    2b:46:c3:4e:b9:ef:de:bd:a6:be:e2:66:79:a9:6a:
+                    0d:c1:b2:e7:5e:03:9d:de:dd:41:b9:c9:80:2c:bd:
+                    6d:1f:09:5f:4e:25:e7:ac:ff:23:47:8f:5f:74:69:
+                    be:81:42:5c:e6:1a:f7:65:1f:eb:a1:d0:69:6f:be:
+                    7e:89
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E4:4D:EE:6A:A3:30:91:37:3E:5C:1D:BD:26:96:5F:FF:DB:D3:E2:15
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                OCSP Signing
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6c:d6:fa:8f:6f:c9:0a:99:0b:ee:6c:27:1f:75:52:b8:82:33:
+        41:fe:01:a1:f8:c5:24:4e:9e:3b:e2:89:0f:01:2b:8e:c4:76:
+        fb:d9:75:5a:b2:9c:e0:36:8d:fd:90:9f:28:92:1b:a3:74:fd:
+        c5:39:28:51:06:ab:95:f7:64:95:e8:7b:d9:97:35:33:97:05:
+        38:87:e6:e6:d7:a5:0b:a1:11:0c:b7:8b:76:b8:a9:46:33:ba:
+        50:b3:3b:96:90:65:4b:ea:14:20:c9:f7:0d:8d:5e:89:c6:78:
+        e3:0b:4f:d2:db:10:46:8a:c4:81:6f:20:13:30:83:a8:45:4d:
+        2b:ef:f0:ce:18:a7:96:fc:b9:67:79:e9:a9:f0:2f:b2:33:1c:
+        83:cf:a3:4b:df:fd:c5:58:ae:87:83:d9:be:22:85:58:41:f5:
+        a0:a2:2d:56:98:40:12:78:c5:43:b0:50:34:0f:6c:0b:52:ad:
+        68:e1:7a:9e:c1:54:58:bf:b4:f1:c5:3b:bf:97:e4:f9:44:09:
+        f5:c7:67:7d:dc:3d:ea:a9:9f:0f:3a:aa:9c:4a:c1:ef:a1:52:
+        25:e4:57:22:d6:af:c6:c9:c8:02:91:4b:ec:a2:d6:ba:b5:bf:
+        ed:22:7c:b2:71:6c:78:f4:ba:e4:b9:b7:1f:11:65:d4:4f:77:
+        4d:ef:b5:43
+-----BEGIN CERTIFICATE-----
+MIIELzCCAxegAwIBAgIUe5c1cysrX3TGQ4OPrmVboPX0/x8wDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTI5MjhaFw0zMzA0MjgxOTI5MjhaMFkxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEZ
+MBcGA1UEAwwQT0NTUCBSZXNwb25kZXIgMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBALiYPQNNXrJmXlE7+T3yeiRrcFwvegWyUXdiReczdXfbMW8tEzLN
+06ADhO75K4Gd5cm64iXJpxgr/fGVrdNGkNl7fzkthbRwfHJEmfvfnyJMgXc1u/5B
+f4b1xylTfO7UzAlU+syxTUvCx8c+GhNZZjYxrmAbagWwW2SWd510zEJuE9Ehg5SO
+bEzYQleUF/8m1NEvZFi1RxoiOGm/wFqcw4gBCh332GiIfFddRMRx0GaNHDngr+j3
+zlFgfB231ee1PmqlK0bDTrnv3r2mvuJmealqDcGy514Dnd7dQbnJgCy9bR8JX04l
+56z/I0ePX3RpvoFCXOYa92Uf66HQaW++fokCAwEAAaOB7TCB6jAdBgNVHQ4EFgQU
+5E3uaqMwkTc+XB29JpZf/9vT4hUwHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyi
+V3ftFawwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAww
+CgYIKwYBBQUHAwkwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovLzEyNy4wLjAuMToy
+ODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYIKwYBBQUHAQEEJzAlMCMGCCsG
+AQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4LzANBgkqhkiG9w0BAQsFAAOC
+AQEAbNb6j2/JCpkL7mwnH3VSuIIzQf4BofjFJE6eO+KJDwErjsR2+9l1WrKc4DaN
+/ZCfKJIbo3T9xTkoUQarlfdkleh72Zc1M5cFOIfm5telC6ERDLeLdripRjO6ULM7
+lpBlS+oUIMn3DY1eicZ44wtP0tsQRorEgW8gEzCDqEVNK+/wzhinlvy5Z3npqfAv
+sjMcg8+jS9/9xViuh4PZviKFWEH1oKItVphAEnjFQ7BQNA9sC1KtaOF6nsFUWL+0
+8cU7v5fk+UQJ9cdnfdw96qmfDzqqnErB76FSJeRXItavxsnIApFL7KLWurW/7SJ8
+snFsePS65Lm3HxFl1E93Te+1Qw==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_cert.pem
new file mode 100644
index 00000000..1f26c384
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_cert.pem
@@ -0,0 +1,92 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7b:97:35:73:2b:2b:5f:74:c6:43:83:8f:ae:65:5b:a0:f5:f4:ff:1f
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: May  1 19:29:28 2023 GMT
+            Not After : Apr 28 19:29:28 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=OCSP Responder 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:98:3d:03:4d:5e:b2:66:5e:51:3b:f9:3d:f2:
+                    7a:24:6b:70:5c:2f:7a:05:b2:51:77:62:45:e7:33:
+                    75:77:db:31:6f:2d:13:32:cd:d3:a0:03:84:ee:f9:
+                    2b:81:9d:e5:c9:ba:e2:25:c9:a7:18:2b:fd:f1:95:
+                    ad:d3:46:90:d9:7b:7f:39:2d:85:b4:70:7c:72:44:
+                    99:fb:df:9f:22:4c:81:77:35:bb:fe:41:7f:86:f5:
+                    c7:29:53:7c:ee:d4:cc:09:54:fa:cc:b1:4d:4b:c2:
+                    c7:c7:3e:1a:13:59:66:36:31:ae:60:1b:6a:05:b0:
+                    5b:64:96:77:9d:74:cc:42:6e:13:d1:21:83:94:8e:
+                    6c:4c:d8:42:57:94:17:ff:26:d4:d1:2f:64:58:b5:
+                    47:1a:22:38:69:bf:c0:5a:9c:c3:88:01:0a:1d:f7:
+                    d8:68:88:7c:57:5d:44:c4:71:d0:66:8d:1c:39:e0:
+                    af:e8:f7:ce:51:60:7c:1d:b7:d5:e7:b5:3e:6a:a5:
+                    2b:46:c3:4e:b9:ef:de:bd:a6:be:e2:66:79:a9:6a:
+                    0d:c1:b2:e7:5e:03:9d:de:dd:41:b9:c9:80:2c:bd:
+                    6d:1f:09:5f:4e:25:e7:ac:ff:23:47:8f:5f:74:69:
+                    be:81:42:5c:e6:1a:f7:65:1f:eb:a1:d0:69:6f:be:
+                    7e:89
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E4:4D:EE:6A:A3:30:91:37:3E:5C:1D:BD:26:96:5F:FF:DB:D3:E2:15
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                OCSP Signing
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6c:d6:fa:8f:6f:c9:0a:99:0b:ee:6c:27:1f:75:52:b8:82:33:
+        41:fe:01:a1:f8:c5:24:4e:9e:3b:e2:89:0f:01:2b:8e:c4:76:
+        fb:d9:75:5a:b2:9c:e0:36:8d:fd:90:9f:28:92:1b:a3:74:fd:
+        c5:39:28:51:06:ab:95:f7:64:95:e8:7b:d9:97:35:33:97:05:
+        38:87:e6:e6:d7:a5:0b:a1:11:0c:b7:8b:76:b8:a9:46:33:ba:
+        50:b3:3b:96:90:65:4b:ea:14:20:c9:f7:0d:8d:5e:89:c6:78:
+        e3:0b:4f:d2:db:10:46:8a:c4:81:6f:20:13:30:83:a8:45:4d:
+        2b:ef:f0:ce:18:a7:96:fc:b9:67:79:e9:a9:f0:2f:b2:33:1c:
+        83:cf:a3:4b:df:fd:c5:58:ae:87:83:d9:be:22:85:58:41:f5:
+        a0:a2:2d:56:98:40:12:78:c5:43:b0:50:34:0f:6c:0b:52:ad:
+        68:e1:7a:9e:c1:54:58:bf:b4:f1:c5:3b:bf:97:e4:f9:44:09:
+        f5:c7:67:7d:dc:3d:ea:a9:9f:0f:3a:aa:9c:4a:c1:ef:a1:52:
+        25:e4:57:22:d6:af:c6:c9:c8:02:91:4b:ec:a2:d6:ba:b5:bf:
+        ed:22:7c:b2:71:6c:78:f4:ba:e4:b9:b7:1f:11:65:d4:4f:77:
+        4d:ef:b5:43
+-----BEGIN CERTIFICATE-----
+MIIELzCCAxegAwIBAgIUe5c1cysrX3TGQ4OPrmVboPX0/x8wDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA1MDExOTI5MjhaFw0zMzA0MjgxOTI5MjhaMFkxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEZ
+MBcGA1UEAwwQT0NTUCBSZXNwb25kZXIgMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBALiYPQNNXrJmXlE7+T3yeiRrcFwvegWyUXdiReczdXfbMW8tEzLN
+06ADhO75K4Gd5cm64iXJpxgr/fGVrdNGkNl7fzkthbRwfHJEmfvfnyJMgXc1u/5B
+f4b1xylTfO7UzAlU+syxTUvCx8c+GhNZZjYxrmAbagWwW2SWd510zEJuE9Ehg5SO
+bEzYQleUF/8m1NEvZFi1RxoiOGm/wFqcw4gBCh332GiIfFddRMRx0GaNHDngr+j3
+zlFgfB231ee1PmqlK0bDTrnv3r2mvuJmealqDcGy514Dnd7dQbnJgCy9bR8JX04l
+56z/I0ePX3RpvoFCXOYa92Uf66HQaW++fokCAwEAAaOB7TCB6jAdBgNVHQ4EFgQU
+5E3uaqMwkTc+XB29JpZf/9vT4hUwHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyi
+V3ftFawwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAww
+CgYIKwYBBQUHAwkwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovLzEyNy4wLjAuMToy
+ODg4OC9pbnRlcm1lZGlhdGUyX2NybC5kZXIwMwYIKwYBBQUHAQEEJzAlMCMGCCsG
+AQUFBzABhhdodHRwOi8vMTI3LjAuMC4xOjI4ODg4LzANBgkqhkiG9w0BAQsFAAOC
+AQEAbNb6j2/JCpkL7mwnH3VSuIIzQf4BofjFJE6eO+KJDwErjsR2+9l1WrKc4DaN
+/ZCfKJIbo3T9xTkoUQarlfdkleh72Zc1M5cFOIfm5telC6ERDLeLdripRjO6ULM7
+lpBlS+oUIMn3DY1eicZ44wtP0tsQRorEgW8gEzCDqEVNK+/wzhinlvy5Z3npqfAv
+sjMcg8+jS9/9xViuh4PZviKFWEH1oKItVphAEnjFQ7BQNA9sC1KtaOF6nsFUWL+0
+8cU7v5fk+UQJ9cdnfdw96qmfDzqqnErB76FSJeRXItavxsnIApFL7KLWurW/7SJ8
+snFsePS65Lm3HxFl1E93Te+1Qw==
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/ocsp2/private/ocsp2_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/private/ocsp2_keypair.pem
new file mode 100644
index 00000000..ad13f6f8
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/ocsp2/private/ocsp2_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC4mD0DTV6yZl5R
+O/k98noka3BcL3oFslF3YkXnM3V32zFvLRMyzdOgA4Tu+SuBneXJuuIlyacYK/3x
+la3TRpDZe385LYW0cHxyRJn7358iTIF3Nbv+QX+G9ccpU3zu1MwJVPrMsU1LwsfH
+PhoTWWY2Ma5gG2oFsFtklneddMxCbhPRIYOUjmxM2EJXlBf/JtTRL2RYtUcaIjhp
+v8BanMOIAQod99hoiHxXXUTEcdBmjRw54K/o985RYHwdt9XntT5qpStGw0657969
+pr7iZnmpag3BsudeA53e3UG5yYAsvW0fCV9OJees/yNHj190ab6BQlzmGvdlH+uh
+0Glvvn6JAgMBAAECggEAIlCyruV4ICPljqZefASSbijG12w/+8UdXdsX8ZXgVWqa
+8vbnJb+bgpiE4sPRMaQ/rlOebLXi6RxsdbeEe80XakaJ7QAoZdWvXLKiCW+VrpOY
+UafcjbRxV45i+qy5gdBvKaDxipG/M8E+0CwcPtKUrKhpqRYPjIUvSDCshcnLmuF3
+zztB/4VyVEUUaM0pEqSZhxSyraRmGARvF1iOSu1npe3AzWTrrjrSkbk6fi4GyECL
+If0EQ1ZD+ZXQ6tcGDyNtmPox7lPMZOgwLJZ5zISXZ6QBjn0JvSzE+e4z0IFinLgx
+q5yBz2BhJEN8OBcs3J2N/ivQetWil64YbrbK6WbocQKBgQD/b4uHOuJVVifjIf6/
+kJ0UHhki4Q2Fj164royDigyyzaZmMzrlReZ5rAQLk8wGqw2hI+9gYoYBYqHm71kd
+WrwLS1TVZJ6x8TBh0sYOG2CPndqIjWFx9Wjjf1xNknwYdIoEdAAKZ/M1E71V0tZb
++Ampl+lHPnKqYRSCd7gbYBU/TQKBgQC5AKGJusjRRRRWQqQ0RdJuxusZrtAAUd7l
+wOGMC0zVQSSvUuegFtWEaZUbByhCARtYp8o4rT6Fw9yOvMaMNcfd8tV5nYVHDsrw
+MurPhPitgI0/LdVvkAOO4fgPZHIXV9GbUDGq4uqB61daBSLQg1JjtzG8GvlGiYZl
+mKOWEXjWLQKBgQC3nHHaehxZpT20yin5f7U50czVwppaqE05Sdcdcq1gFe2Hx0mN
+pypdyaV6wPnGzUxVyaP3T7rt4f1pKCGRtTg4kiTf450jYbEakEzntQw7EAgXYjFq
+njKQXWt3I1XqqlLPkqa41DIBtDfEKnMF1wzzCIyaNqxsBq6cffwsSWvcfQKBgF/y
+UNUCd0X5Yqu+EjU+BP4I0kNWo2+XBlf36cHc1nM/Psxi3dfsH751l6wV0S4yLsGS
++9DbILL1On0YsIxlFAwq9cYGCOoqZNugPKF1oBcztY2PssMSWJYQ4brx6C3tELtR
+IwEygFby/DGmukCT6vXmO7gH8UJA7t/gAu9Ajn/dAoGAI/Ejqb7HborIvCw/p+kB
+JkPIhTUuT5XonDm8h6KHWUESPikS7SMeRM/4V+AL/Y5MiiCBfjh3tCOup/16x6GQ
+4z6FvcIaYusxKup+afQaDyv1Phv5/mr74liLhC5Qp9EGU2FZrMZwG3EZjSn/0IE+
+dBJeWNtNHiFPcyTzYMMhDBw=
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/root/private/root_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/root/private/root_keypair.pem
new file mode 100644
index 00000000..dd6f2fb0
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/root/private/root_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDiIWuf70i53iL7
+WzcJaMe1kldSJO+FAOhxhU0PW4zG508Z9uMLcKNBfnHUD9b98hrKqleRdpqygmJg
+zvIALtS8WNNgMEKmKLJQe1gBn/sKZbBA1nzit9qNGdmlUdJGfhRGq/rfzv6ECJhj
+Rh1NindXZ9oWizIMfEHipezufSAo6wNf9eYF2IuWeG+uKZpQ99yWMYaBsXjo6+9d
+u+1C7JTGVEbsBW8bDDYkxqgGflxWuEM7EfQGCgUVGTsfyGcx6ztbKhUKe/lr5BDu
+RL4Z2NtEAfo6VvVsTvNgquTNsq13B0Xv8df1+lKEXANOcuCpkcXZ1gqEM5gx8gJb
+PxAVZXbXAgMBAAECggEAW6YC6i+/cIFs+SW3cStT4a29kU/h+axsCPJnUIWg0U6X
+WyUaUR0mNZmrRbDjyEmS/Te7xPtmaFn6yFSndVaFpw5zIQV+RbyxxHexK/tscgLT
+w/uKYxLz04M6GExIpoRb8Gash3/r3JRlOrsEjlRD2RuAoulob/H+e/8Wv3PcEGio
+R8jwCj5DEnWiMxDzgtxsVgR4OeRYqg3zKjWrLALEYoRbFTVncCVA40OnmGJZ3+E5
++3OOX6p9y/nY36888345yuwiCOTdNwQVaCXnLDZlAIVpB8QmjXVB35RSs+r2H5SF
+p/KRbZ/JNKdNrbTKfJyvbnIpyTAtJB9OkhyiR9AegQKBgQDkKAplyZ6ChT3l53nn
+4ngFi/nSTfrfJepmA5lVJk1Wxk0a4W++HxJkdKY2sUP7WuQ1xaPdcHxKzfp2HQE5
+L95jObU5dtY64QD4q0xqOw1ISDQi1euqZEmZziupEgPcMtw4sAVhHohzvTWo6a8o
+fGMSkLTd+2303xgBCZo2I/hZVwKBgQD9uha6pQmCg4Oi2i/38Vm3ByArnQvgkELC
+eGBBJrCE8pSm+ToPtgL+gSuA8PlWzIYlIf0UVOJFyws8GkUFm6n0nUlN0NmK8Rhm
+Bg4IvasxdRgtySJzZO7ipAqGIaWJIBi1Vj4/rnAVggkadbQgyw+eCZNc5Pg3D9MV
+TJ7d/xHegQKBgQCprGVfITuyUSihKy3rlu4vIdPd5IQnI2lYCGElg+CMIdkBnpmd
+SDpDXsSlc9rcuNFyc9LTQW4Nq3USFavtPX4jSK1PWOMk0mQIiku/zL6p/JhZN8GU
+7BQYP80UZQNd5K0Fs1Gs0ioj+JhJT9AlSavcCKWZV/yD2M1fKCb5EHMG7QKBgQDV
+SvtSeeytp8sgOtU6VMz7fOUBZOsYI43Ll5ArFNAtYxOt7jNuA68urf2ZTnn9Cr/2
+NUVgMx9oVpEiPF8roLlV5mc6IEjQcW72TT69AF0KnYnu63enlADxy78BFQXoaW/7
++P0pYYXdvsvST4JWUv3U9+3GmMFE4GutKxUeQA+QgQKBgQCauejVixhfKcmkM9nn
+MGLSOUuFyd9HpQk3efxylphFNjpohk+k3fVKXBhmE4BDXbSlYUmMemm27tuQ/I6Z
+bWOjGl57ZbCgJ7LdXLanJhyJJ6cSmkX8+oD+fwPMrD8yaAfh37MdTnriZKIDMXp2
+7HtfLcz0evmbW06b/dReyvcqyQ==
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/root/root_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/root/root_cert.pem
new file mode 100644
index 00000000..f4658e14
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/root/root_cert.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem
new file mode 100644
index 00000000..544e3d44
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:c4:82:66:f8:5d:a6:b6:c7:66:e1:b2:01:3f:e0:72:fc:72:61:33
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:33:37 2023 GMT
+            Not After : Apr 28 19:33:37 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:af:26:5c:50:c0:fa:62:b5:fd:3d:c1:9e:26:51:
+                    58:62:04:37:b0:b5:6a:9b:6a:e3:22:3c:cd:ee:3c:
+                    e7:8b:d3:e2:4c:08:1a:4d:63:c1:81:20:f4:53:a5:
+                    5d:2f:d2:71:d8:af:e3:26:95:b4:27:14:46:7f:e2:
+                    0a:73:12:a7:0e:ff:99:5a:29:f5:d0:65:96:b1:d1:
+                    96:7f:0c:43:b8:71:f2:4b:21:e1:97:6c:1b:01:e5:
+                    38:1a:39:44:72:d5:19:20:87:fe:90:4f:3b:97:f2:
+                    7d:bd:57:97:4d:9d:56:50:89:5b:79:29:7a:3a:13:
+                    97:08:61:c2:0c:a6:02:49:c9:8a:41:ab:8e:9f:25:
+                    c9:33:18:f8:92:64:58:04:cc:a3:9d:cf:d4:d2:bd:
+                    20:ab:8b:9d:55:df:fb:5b:23:ac:95:12:fa:6f:07:
+                    93:3f:0e:03:86:c4:9b:25:06:21:9b:03:96:32:b8:
+                    e0:0f:63:e2:1d:34:d1:41:35:19:09:c1:a0:dc:26:
+                    b9:c8:66:fa:87:67:22:6e:0c:a6:e7:0f:24:64:b1:
+                    4f:84:05:ef:ad:8e:1b:f2:f4:38:87:d3:e3:48:a5:
+                    82:e0:66:89:1d:92:9a:59:67:a4:1d:03:6f:4d:a5:
+                    fb:3b:c0:0b:73:a7:ab:8f:b4:10:25:8e:69:42:76:
+                    82:5f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                43:16:E6:03:AF:37:B2:7B:BD:B3:C8:A2:9C:95:D7:FA:32:F8:9E:6F
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        a3:87:9f:05:e4:38:61:f7:c4:5b:17:13:4b:2c:9d:a2:4d:e6:
+        ad:93:54:c5:a3:00:27:0b:5c:45:c5:bd:f8:b6:a7:5a:2a:ec:
+        dc:9b:59:8a:c7:59:e7:b9:86:f7:27:be:45:0d:d9:86:76:cf:
+        00:71:ad:aa:cc:73:50:8c:68:63:b0:e2:3a:59:dd:85:fa:0d:
+        f0:82:51:05:79:e6:d5:0e:0b:bb:ed:23:65:8f:d0:8b:01:df:
+        86:74:bc:3a:22:90:e4:59:44:91:d5:44:d8:21:4d:4e:10:72:
+        0a:12:2e:4a:20:5f:15:e7:16:0b:6f:76:f3:04:1f:da:44:50:
+        3b:c3:b3:0f:fa:05:cf:6e:64:9c:65:e2:0d:38:28:31:c3:c3:
+        b6:66:ef:80:d3:c4:5f:e9:f9:01:e9:ce:e6:99:46:a0:9d:ce:
+        90:63:77:d2:85:21:d7:88:32:55:38:fe:10:07:69:cd:c8:06:
+        b7:6f:49:98:bf:cd:be:4f:ab:44:ea:78:af:ab:01:c8:3e:fa:
+        d9:54:bc:59:28:db:03:9b:1c:ee:e4:c3:ed:f3:97:30:c6:40:
+        33:76:84:40:b2:b8:4d:b4:ca:a9:2d:d1:4d:17:92:ea:c0:c9:
+        cb:f6:b1:d7:d3:c7:e6:75:15:00:ff:c7:d9:54:63:27:19:5c:
+        96:a5:e5:d9
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUPMSCZvhdprbHZuGyAT/gcvxyYTMwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTMzMzdaFw0zMzA0MjgxOTMzMzdaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCvJlxQwPpitf09wZ4mUVhiBDewtWqbauMiPM3uPOeL0+JMCBpNY8GBIPRT
+pV0v0nHYr+MmlbQnFEZ/4gpzEqcO/5laKfXQZZax0ZZ/DEO4cfJLIeGXbBsB5Tga
+OURy1Rkgh/6QTzuX8n29V5dNnVZQiVt5KXo6E5cIYcIMpgJJyYpBq46fJckzGPiS
+ZFgEzKOdz9TSvSCri51V3/tbI6yVEvpvB5M/DgOGxJslBiGbA5YyuOAPY+IdNNFB
+NRkJwaDcJrnIZvqHZyJuDKbnDyRksU+EBe+tjhvy9DiH0+NIpYLgZokdkppZZ6Qd
+A29Npfs7wAtzp6uPtBAljmlCdoJfAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUQxbm
+A683snu9s8iinJXX+jL4nm8wHwYDVR0jBBgwFoAUtZFuT2S3FoR2+bS+mc5glZga
+jp0wDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ludGVybWVkaWF0ZTFfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+MTg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAo4efBeQ4YffEWxcTSyydok3mrZNUxaMAJwtcRcW9+LanWirs3JtZisdZ
+57mG9ye+RQ3ZhnbPAHGtqsxzUIxoY7DiOlndhfoN8IJRBXnm1Q4Lu+0jZY/QiwHf
+hnS8OiKQ5FlEkdVE2CFNThByChIuSiBfFecWC2928wQf2kRQO8OzD/oFz25knGXi
+DTgoMcPDtmbvgNPEX+n5AenO5plGoJ3OkGN30oUh14gyVTj+EAdpzcgGt29JmL/N
+vk+rROp4r6sByD762VS8WSjbA5sc7uTD7fOXMMZAM3aEQLK4TbTKqS3RTReS6sDJ
+y/ax19PH5nUVAP/H2VRjJxlclqXl2Q==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem
new file mode 100644
index 00000000..ef73af87
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:c4:82:66:f8:5d:a6:b6:c7:66:e1:b2:01:3f:e0:72:fc:72:61:33
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:33:37 2023 GMT
+            Not After : Apr 28 19:33:37 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:af:26:5c:50:c0:fa:62:b5:fd:3d:c1:9e:26:51:
+                    58:62:04:37:b0:b5:6a:9b:6a:e3:22:3c:cd:ee:3c:
+                    e7:8b:d3:e2:4c:08:1a:4d:63:c1:81:20:f4:53:a5:
+                    5d:2f:d2:71:d8:af:e3:26:95:b4:27:14:46:7f:e2:
+                    0a:73:12:a7:0e:ff:99:5a:29:f5:d0:65:96:b1:d1:
+                    96:7f:0c:43:b8:71:f2:4b:21:e1:97:6c:1b:01:e5:
+                    38:1a:39:44:72:d5:19:20:87:fe:90:4f:3b:97:f2:
+                    7d:bd:57:97:4d:9d:56:50:89:5b:79:29:7a:3a:13:
+                    97:08:61:c2:0c:a6:02:49:c9:8a:41:ab:8e:9f:25:
+                    c9:33:18:f8:92:64:58:04:cc:a3:9d:cf:d4:d2:bd:
+                    20:ab:8b:9d:55:df:fb:5b:23:ac:95:12:fa:6f:07:
+                    93:3f:0e:03:86:c4:9b:25:06:21:9b:03:96:32:b8:
+                    e0:0f:63:e2:1d:34:d1:41:35:19:09:c1:a0:dc:26:
+                    b9:c8:66:fa:87:67:22:6e:0c:a6:e7:0f:24:64:b1:
+                    4f:84:05:ef:ad:8e:1b:f2:f4:38:87:d3:e3:48:a5:
+                    82:e0:66:89:1d:92:9a:59:67:a4:1d:03:6f:4d:a5:
+                    fb:3b:c0:0b:73:a7:ab:8f:b4:10:25:8e:69:42:76:
+                    82:5f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                43:16:E6:03:AF:37:B2:7B:BD:B3:C8:A2:9C:95:D7:FA:32:F8:9E:6F
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        a3:87:9f:05:e4:38:61:f7:c4:5b:17:13:4b:2c:9d:a2:4d:e6:
+        ad:93:54:c5:a3:00:27:0b:5c:45:c5:bd:f8:b6:a7:5a:2a:ec:
+        dc:9b:59:8a:c7:59:e7:b9:86:f7:27:be:45:0d:d9:86:76:cf:
+        00:71:ad:aa:cc:73:50:8c:68:63:b0:e2:3a:59:dd:85:fa:0d:
+        f0:82:51:05:79:e6:d5:0e:0b:bb:ed:23:65:8f:d0:8b:01:df:
+        86:74:bc:3a:22:90:e4:59:44:91:d5:44:d8:21:4d:4e:10:72:
+        0a:12:2e:4a:20:5f:15:e7:16:0b:6f:76:f3:04:1f:da:44:50:
+        3b:c3:b3:0f:fa:05:cf:6e:64:9c:65:e2:0d:38:28:31:c3:c3:
+        b6:66:ef:80:d3:c4:5f:e9:f9:01:e9:ce:e6:99:46:a0:9d:ce:
+        90:63:77:d2:85:21:d7:88:32:55:38:fe:10:07:69:cd:c8:06:
+        b7:6f:49:98:bf:cd:be:4f:ab:44:ea:78:af:ab:01:c8:3e:fa:
+        d9:54:bc:59:28:db:03:9b:1c:ee:e4:c3:ed:f3:97:30:c6:40:
+        33:76:84:40:b2:b8:4d:b4:ca:a9:2d:d1:4d:17:92:ea:c0:c9:
+        cb:f6:b1:d7:d3:c7:e6:75:15:00:ff:c7:d9:54:63:27:19:5c:
+        96:a5:e5:d9
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUPMSCZvhdprbHZuGyAT/gcvxyYTMwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTMzMzdaFw0zMzA0MjgxOTMzMzdaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCvJlxQwPpitf09wZ4mUVhiBDewtWqbauMiPM3uPOeL0+JMCBpNY8GBIPRT
+pV0v0nHYr+MmlbQnFEZ/4gpzEqcO/5laKfXQZZax0ZZ/DEO4cfJLIeGXbBsB5Tga
+OURy1Rkgh/6QTzuX8n29V5dNnVZQiVt5KXo6E5cIYcIMpgJJyYpBq46fJckzGPiS
+ZFgEzKOdz9TSvSCri51V3/tbI6yVEvpvB5M/DgOGxJslBiGbA5YyuOAPY+IdNNFB
+NRkJwaDcJrnIZvqHZyJuDKbnDyRksU+EBe+tjhvy9DiH0+NIpYLgZokdkppZZ6Qd
+A29Npfs7wAtzp6uPtBAljmlCdoJfAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUQxbm
+A683snu9s8iinJXX+jL4nm8wHwYDVR0jBBgwFoAUtZFuT2S3FoR2+bS+mc5glZga
+jp0wDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ludGVybWVkaWF0ZTFfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+MTg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAo4efBeQ4YffEWxcTSyydok3mrZNUxaMAJwtcRcW9+LanWirs3JtZisdZ
+57mG9ye+RQ3ZhnbPAHGtqsxzUIxoY7DiOlndhfoN8IJRBXnm1Q4Lu+0jZY/QiwHf
+hnS8OiKQ5FlEkdVE2CFNThByChIuSiBfFecWC2928wQf2kRQO8OzD/oFz25knGXi
+DTgoMcPDtmbvgNPEX+n5AenO5plGoJ3OkGN30oUh14gyVTj+EAdpzcgGt29JmL/N
+vk+rROp4r6sByD762VS8WSjbA5sc7uTD7fOXMMZAM3aEQLK4TbTKqS3RTReS6sDJ
+y/ax19PH5nUVAP/H2VRjJxlclqXl2Q==
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem
new file mode 100644
index 00000000..aacb9be1
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            2e:91:da:29:59:ff:c4:64:bf:02:bc:27:bb:e3:35:4e:5b:36:f7:91
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:33:53 2023 GMT
+            Not After : Apr 28 19:33:53 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ac:48:ce:a7:b2:ad:7a:68:01:55:3f:86:20:7e:
+                    bb:26:e6:88:f3:ae:04:15:7d:d9:64:98:85:bc:eb:
+                    bd:d8:0a:c7:26:c4:8e:27:56:8c:a8:9f:51:37:a9:
+                    ec:8a:dc:af:27:05:0c:f5:c0:19:b1:2c:0d:56:66:
+                    7b:7e:b1:8f:ab:34:61:56:37:a8:ab:51:d6:1d:e6:
+                    a7:56:b2:51:72:57:9b:c5:87:84:6c:ef:e6:18:d4:
+                    45:b8:ef:52:72:11:02:81:61:f2:36:63:25:18:31:
+                    7f:c7:91:89:c3:b0:73:13:f0:26:1f:a1:4f:8c:ff:
+                    94:1c:75:a6:be:38:7d:81:06:33:dd:7b:86:81:c5:
+                    1f:d2:5d:f6:ea:3f:9f:ab:fb:e7:97:3c:72:ea:b3:
+                    83:ab:49:88:ac:a9:4b:81:db:fa:e3:bf:79:d9:6e:
+                    90:bf:8f:68:d8:05:f8:52:ad:98:41:29:e0:2a:18:
+                    98:b6:b2:61:78:02:02:52:85:02:e0:63:f4:a0:55:
+                    80:c9:66:8b:ac:4f:8b:36:f4:56:8f:cf:bd:67:86:
+                    72:92:0b:f9:73:7b:05:cc:3d:91:ed:ed:4f:f0:8f:
+                    36:99:e5:51:7f:ee:9e:fb:e5:5c:d0:39:a2:f5:51:
+                    06:92:3c:ad:cc:59:9d:0a:81:50:26:30:01:e9:f4:
+                    b1:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                CD:65:B9:5C:48:35:F7:1E:85:6E:94:50:78:72:BB:3F:F7:BC:22:A6
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6f:de:f3:92:b2:8b:57:61:7a:b9:06:49:3e:af:e0:1c:3a:d4:
+        42:52:fe:d0:7d:97:8a:9b:d0:6d:b9:f3:e6:8b:2a:40:ce:aa:
+        ed:bb:ce:21:e8:ae:32:9d:eb:5a:00:e0:c1:3a:d7:40:74:1b:
+        43:e4:43:f0:61:bf:40:06:75:52:1b:b9:f4:b5:32:55:94:f5:
+        84:98:90:cc:27:92:91:b7:3d:8e:f1:12:bf:37:1a:8a:50:41:
+        3a:14:0c:cf:93:fe:57:97:7b:fe:af:b9:c0:c2:d6:bb:20:e4:
+        0a:6f:12:0b:60:a6:cc:59:46:db:99:db:61:71:d3:a7:f5:a1:
+        d0:d6:81:87:57:a3:dd:b6:e1:ab:2f:4f:b6:51:21:ec:a6:95:
+        df:d3:ab:e5:a1:67:a3:ba:b1:b9:71:39:a1:3b:db:5e:c5:6f:
+        b1:34:27:ae:6d:f6:67:4c:7d:7c:6d:12:37:6f:b5:0b:5a:85:
+        aa:5d:fd:03:de:59:b5:20:7a:ea:84:a0:a5:75:60:12:12:08:
+        77:0e:46:d6:fa:57:fa:b1:43:42:54:38:d7:66:67:cd:fc:b6:
+        f9:4c:fe:99:71:2b:d5:a6:13:2f:2e:f0:a3:9e:fc:47:03:31:
+        79:38:e3:50:8a:de:81:97:80:9e:46:71:5c:9f:e5:de:0c:49:
+        fc:f5:61:1c
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIULpHaKVn/xGS/Arwnu+M1Tls295EwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTMzNTNaFw0zMzA0MjgxOTMzNTNaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCsSM6nsq16aAFVP4Ygfrsm5ojzrgQVfdlkmIW8673YCscmxI4nVoyon1E3
+qeyK3K8nBQz1wBmxLA1WZnt+sY+rNGFWN6irUdYd5qdWslFyV5vFh4Rs7+YY1EW4
+71JyEQKBYfI2YyUYMX/HkYnDsHMT8CYfoU+M/5Qcdaa+OH2BBjPde4aBxR/SXfbq
+P5+r++eXPHLqs4OrSYisqUuB2/rjv3nZbpC/j2jYBfhSrZhBKeAqGJi2smF4AgJS
+hQLgY/SgVYDJZousT4s29FaPz71nhnKSC/lzewXMPZHt7U/wjzaZ5VF/7p775VzQ
+OaL1UQaSPK3MWZ0KgVAmMAHp9LHpAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUzWW5
+XEg19x6FbpRQeHK7P/e8IqYwHwYDVR0jBBgwFoAUtZFuT2S3FoR2+bS+mc5glZga
+jp0wDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ludGVybWVkaWF0ZTFfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+MTg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAb97zkrKLV2F6uQZJPq/gHDrUQlL+0H2XipvQbbnz5osqQM6q7bvOIeiu
+Mp3rWgDgwTrXQHQbQ+RD8GG/QAZ1Uhu59LUyVZT1hJiQzCeSkbc9jvESvzcailBB
+OhQMz5P+V5d7/q+5wMLWuyDkCm8SC2CmzFlG25nbYXHTp/Wh0NaBh1ej3bbhqy9P
+tlEh7KaV39Or5aFno7qxuXE5oTvbXsVvsTQnrm32Z0x9fG0SN2+1C1qFql39A95Z
+tSB66oSgpXVgEhIIdw5G1vpX+rFDQlQ412Znzfy2+Uz+mXEr1aYTLy7wo578RwMx
+eTjjUIregZeAnkZxXJ/l3gxJ/PVhHA==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem
new file mode 100644
index 00000000..91ddf565
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            2e:91:da:29:59:ff:c4:64:bf:02:bc:27:bb:e3:35:4e:5b:36:f7:91
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:33:53 2023 GMT
+            Not After : Apr 28 19:33:53 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ac:48:ce:a7:b2:ad:7a:68:01:55:3f:86:20:7e:
+                    bb:26:e6:88:f3:ae:04:15:7d:d9:64:98:85:bc:eb:
+                    bd:d8:0a:c7:26:c4:8e:27:56:8c:a8:9f:51:37:a9:
+                    ec:8a:dc:af:27:05:0c:f5:c0:19:b1:2c:0d:56:66:
+                    7b:7e:b1:8f:ab:34:61:56:37:a8:ab:51:d6:1d:e6:
+                    a7:56:b2:51:72:57:9b:c5:87:84:6c:ef:e6:18:d4:
+                    45:b8:ef:52:72:11:02:81:61:f2:36:63:25:18:31:
+                    7f:c7:91:89:c3:b0:73:13:f0:26:1f:a1:4f:8c:ff:
+                    94:1c:75:a6:be:38:7d:81:06:33:dd:7b:86:81:c5:
+                    1f:d2:5d:f6:ea:3f:9f:ab:fb:e7:97:3c:72:ea:b3:
+                    83:ab:49:88:ac:a9:4b:81:db:fa:e3:bf:79:d9:6e:
+                    90:bf:8f:68:d8:05:f8:52:ad:98:41:29:e0:2a:18:
+                    98:b6:b2:61:78:02:02:52:85:02:e0:63:f4:a0:55:
+                    80:c9:66:8b:ac:4f:8b:36:f4:56:8f:cf:bd:67:86:
+                    72:92:0b:f9:73:7b:05:cc:3d:91:ed:ed:4f:f0:8f:
+                    36:99:e5:51:7f:ee:9e:fb:e5:5c:d0:39:a2:f5:51:
+                    06:92:3c:ad:cc:59:9d:0a:81:50:26:30:01:e9:f4:
+                    b1:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                CD:65:B9:5C:48:35:F7:1E:85:6E:94:50:78:72:BB:3F:F7:BC:22:A6
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6f:de:f3:92:b2:8b:57:61:7a:b9:06:49:3e:af:e0:1c:3a:d4:
+        42:52:fe:d0:7d:97:8a:9b:d0:6d:b9:f3:e6:8b:2a:40:ce:aa:
+        ed:bb:ce:21:e8:ae:32:9d:eb:5a:00:e0:c1:3a:d7:40:74:1b:
+        43:e4:43:f0:61:bf:40:06:75:52:1b:b9:f4:b5:32:55:94:f5:
+        84:98:90:cc:27:92:91:b7:3d:8e:f1:12:bf:37:1a:8a:50:41:
+        3a:14:0c:cf:93:fe:57:97:7b:fe:af:b9:c0:c2:d6:bb:20:e4:
+        0a:6f:12:0b:60:a6:cc:59:46:db:99:db:61:71:d3:a7:f5:a1:
+        d0:d6:81:87:57:a3:dd:b6:e1:ab:2f:4f:b6:51:21:ec:a6:95:
+        df:d3:ab:e5:a1:67:a3:ba:b1:b9:71:39:a1:3b:db:5e:c5:6f:
+        b1:34:27:ae:6d:f6:67:4c:7d:7c:6d:12:37:6f:b5:0b:5a:85:
+        aa:5d:fd:03:de:59:b5:20:7a:ea:84:a0:a5:75:60:12:12:08:
+        77:0e:46:d6:fa:57:fa:b1:43:42:54:38:d7:66:67:cd:fc:b6:
+        f9:4c:fe:99:71:2b:d5:a6:13:2f:2e:f0:a3:9e:fc:47:03:31:
+        79:38:e3:50:8a:de:81:97:80:9e:46:71:5c:9f:e5:de:0c:49:
+        fc:f5:61:1c
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIULpHaKVn/xGS/Arwnu+M1Tls295EwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTMzNTNaFw0zMzA0MjgxOTMzNTNaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCsSM6nsq16aAFVP4Ygfrsm5ojzrgQVfdlkmIW8673YCscmxI4nVoyon1E3
+qeyK3K8nBQz1wBmxLA1WZnt+sY+rNGFWN6irUdYd5qdWslFyV5vFh4Rs7+YY1EW4
+71JyEQKBYfI2YyUYMX/HkYnDsHMT8CYfoU+M/5Qcdaa+OH2BBjPde4aBxR/SXfbq
+P5+r++eXPHLqs4OrSYisqUuB2/rjv3nZbpC/j2jYBfhSrZhBKeAqGJi2smF4AgJS
+hQLgY/SgVYDJZousT4s29FaPz71nhnKSC/lzewXMPZHt7U/wjzaZ5VF/7p775VzQ
+OaL1UQaSPK3MWZ0KgVAmMAHp9LHpAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUzWW5
+XEg19x6FbpRQeHK7P/e8IqYwHwYDVR0jBBgwFoAUtZFuT2S3FoR2+bS+mc5glZga
+jp0wDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ludGVybWVkaWF0ZTFfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+MTg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAb97zkrKLV2F6uQZJPq/gHDrUQlL+0H2XipvQbbnz5osqQM6q7bvOIeiu
+Mp3rWgDgwTrXQHQbQ+RD8GG/QAZ1Uhu59LUyVZT1hJiQzCeSkbc9jvESvzcailBB
+OhQMz5P+V5d7/q+5wMLWuyDkCm8SC2CmzFlG25nbYXHTp/Wh0NaBh1ej3bbhqy9P
+tlEh7KaV39Or5aFno7qxuXE5oTvbXsVvsTQnrm32Z0x9fG0SN2+1C1qFql39A95Z
+tSB66oSgpXVgEhIIdw5G1vpX+rFDQlQ412Znzfy2+Uz+mXEr1aYTLy7wo578RwMx
+eTjjUIregZeAnkZxXJ/l3gxJ/PVhHA==
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem
new file mode 100644
index 00000000..2ea703d5
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCvJlxQwPpitf09
+wZ4mUVhiBDewtWqbauMiPM3uPOeL0+JMCBpNY8GBIPRTpV0v0nHYr+MmlbQnFEZ/
+4gpzEqcO/5laKfXQZZax0ZZ/DEO4cfJLIeGXbBsB5TgaOURy1Rkgh/6QTzuX8n29
+V5dNnVZQiVt5KXo6E5cIYcIMpgJJyYpBq46fJckzGPiSZFgEzKOdz9TSvSCri51V
+3/tbI6yVEvpvB5M/DgOGxJslBiGbA5YyuOAPY+IdNNFBNRkJwaDcJrnIZvqHZyJu
+DKbnDyRksU+EBe+tjhvy9DiH0+NIpYLgZokdkppZZ6QdA29Npfs7wAtzp6uPtBAl
+jmlCdoJfAgMBAAECggEAQLRoOEECfwMCehUUKs20XAl41WQ/7QiQvm4+GXwQgjyV
+hkccCGkI7H5TJK+bfHY/LrDTtsZpVmKMJORJvfcvFkBg08lakVFmWWy3L1pFjlcy
+DoWGxJzgYVPf5PgxDEcjUDxNU9yhhGHGB/Pa5oZwg7Iqw9kJ2XixPBx5RpjxkXYw
+tR8V3IaKq0YRI5lpUfuaofmJnHJnWCMTmawWMxWuTlzlbDDZTHQs8aTDUnwZ26kD
+6tYB2Tp3aP3zUE8MQZwOEyhRH1WQeS3kcIWh4UnPyA09g0aTb6YK8qacnTL2CixF
+VJpLDtlkQk0TCo06AZkcvWkPTQyFXnVsgkG8rRUlEQKBgQDrTHyf6merJAohUeBV
+5IIfoKHWbGc1DXSdmHtCSN9wFGkhCYtfCZ7YaSLjFF7GOvd6mfHJVnIp3aFONqM7
+dk/MZDsAvogO6lU+zgQc+EcKk+e6zyfsUYghy/R3+QKsYtd4SyNDq6cl80MUujjG
+pE2b41O57sNCVZgywCCGXvt/ZwKBgQC+jyufgKRIptM+OOhHlKUaxkTDaMHA1KKY
+iFPLuLgWmyCYHQq2D6uoCRGnEguEnXtbtOz6SYlMMNfeHtX0SATkdCGae/bh5ibG
+uQoWwRMkRkAgl1gyAh7h669pDUiD2gh0q56cS8El7Jgze7NRF4hUyY2mWc5nGhVR
+7rHKlOCiSQKBgHBiWevvg5BkaEo91w5vVA9TI7lMkYbvZFGZcNXaBI590TCsZFsC
+N1JZ9QXMxu+bXnS6bpehqGmCp/a5dgGCot6WyO+0ETw+hHS45ZIIq7XLqxS4uPLQ
+hlrOFXfwAWzg0NVt3ewGYpFnvRR7VX7bHw5j56uY9L4ML+OdjGthlnHlAoGAZAm7
+R/f7xtw1h7POVU22w3CUxtUm6jl2xobDHu7xTYTQvqp4Zg2h+wwPxVqWy171VLaN
+tfOG7YWyvbwIbD6mutwwi+5KNFtjve2EW1+u0dtDbRimx1IPrmDRbF/50qZSzBUQ
+plKqqmMjn9tvzsGA46oP/+WjksLBsIqTsZsotmkCgYAn8Ap+e6ZNX2uM8Kg7LB+T
+hBNGczNOGQX8SpfCeH9eV4VzfpEHn8Fxk+lcI2WpYkandQ8ju2s0mT5OoQ2VjxGT
+eql9jMd8MQZTx/aWridt5qG3hsFcx9GILlcXTUqyRH0SFAU7xDO5HzzKP3tiW6BN
+YE3GakolPPymOR9q69sT0Q==
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem
new file mode 100644
index 00000000..7b76a48d
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCsSM6nsq16aAFV
+P4Ygfrsm5ojzrgQVfdlkmIW8673YCscmxI4nVoyon1E3qeyK3K8nBQz1wBmxLA1W
+Znt+sY+rNGFWN6irUdYd5qdWslFyV5vFh4Rs7+YY1EW471JyEQKBYfI2YyUYMX/H
+kYnDsHMT8CYfoU+M/5Qcdaa+OH2BBjPde4aBxR/SXfbqP5+r++eXPHLqs4OrSYis
+qUuB2/rjv3nZbpC/j2jYBfhSrZhBKeAqGJi2smF4AgJShQLgY/SgVYDJZousT4s2
+9FaPz71nhnKSC/lzewXMPZHt7U/wjzaZ5VF/7p775VzQOaL1UQaSPK3MWZ0KgVAm
+MAHp9LHpAgMBAAECggEABbGGbngQX9Un+x8FQesSPgHnGM92wtY6J5Gwn2qhJy6M
+VYwwFZ3Nz5pBPbrOY9SRGhPihrdixKOWgWppA8ne0WB4JC26HnGZnFAbAQRVqPbQ
+duhd4ILpOpzpkh1K6b+vvU0addXpsUlHJjYZmdy+9tPBkhtwz1xDCFGShrguR0Pa
+WTudsee4skdGfw6wMyHEfM4IXXuSfb1hIse1xlnZMPXMMi3ebCqpOy4IzJ4ML7sF
+RySdrdAHcWJqOQjPkDTOPCXpthBn3iQ8Fa7Znd0GGLZvdRbq3p10H5LNhMg+LBc7
+oRVQ67qAfQKPHKQMSsR4x2fWo8/hw/QEi3cj6CohYQKBgQDtjDBm7VfbLojZeCMx
++32EZ0bLUTob5qInTKpDbdKcYmxP857LRAglaGu+pkOTnHi6lOjJYSiBDd1+vWm/
+1lgMUjKerI0l5ol5yRHWNDFyeQoh10TqEUbIUqB8E5Vi4gl0DlpnsfEm899rlfhP
+dmi1rNpc/C7ZK8Zpt7l4eLbqYQKBgQC5qs+K01WwjtrjoqkEwKqjy7ASrbBuZ56u
+wOe+iO7pYVP4/VdAvOsfEYCWfjhoETYGKob9ZZlo3StpQ5Ku5CigpWQVSCvJhO2T
+KQe75DfXXxaqoPmlNcqAFpqY383Sm+1r3a815sg83XhQAu7GdCyTrLocBLM9SFWX
+fVbojv/EiQKBgBlOpCFzC7cYIBA7ElTS3C5s6kfi4XPzgDb7nfANFTD/81YZOEOj
+fdKuazwmbnCdbOdD0gESTsRg+8Xy2/9KEJtPboElFOyCwQauey385X+ykXfFfVwK
+dyYEV4CgfXvJZQRuOwdtF6n0tUq68XdVwBYK0kCxxTPxy/ObVTEWezZBAoGAPPX2
+evB0vCnLeN5ZfHP+ExW31AovWbCwC1TPQmIXf40zUxdrZJgi4uqOO9tpjdHI2TFx
+bRXEzwd/T2qeaMoFBOoI+Gvf5KS+lIjuPyTpqM9R0+hSz4nf2TqSvAsPu0zzIW2C
+L8J8kG9vJ2YvG/3c/QfDe5uXdlGfuMOwm18IX3ECgYAelsVWNSm9YR2H7S6dlgjm
+8U1IZO342Ab5qlrIWn9Vr/X9MRsAASlVVESeNeQTToBoub5pakUrpz9nNQy29+TX
+xYju72RsCjKywKXWZrCAdHfY+wJJWVo5XkdDZJVl2AYrnP3C07S9aKIjhpGHwz7n
+jbbCEkHZREMbQJCQjuKT1w==
+-----END PRIVATE KEY-----
diff --git a/test/ocsp_peer_test.go b/test/ocsp_peer_test.go
new file mode 100644
index 00000000..8a2d1699
--- /dev/null
+++ b/test/ocsp_peer_test.go
@@ -0,0 +1,2875 @@
+// Copyright 2023 The NATS Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/ocsp"
+
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+)
+
+func newOCSPResponderRootCA(t *testing.T) *http.Server {
+	t.Helper()
+	respCertPEM := "configs/certs/ocsp_peer/mini-ca/caocsp/caocsp_cert.pem"
+	respKeyPEM := "configs/certs/ocsp_peer/mini-ca/caocsp/private/caocsp_keypair.pem"
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+	return newOCSPResponderDesignatedCustomAddress(t, issuerCertPEM, respCertPEM, respKeyPEM, "127.0.0.1:8888")
+}
+
+func newOCSPResponderIntermediateCA1(t *testing.T) *http.Server {
+	t.Helper()
+	respCertPEM := "configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem"
+	respKeyPEM := "configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem"
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem"
+	return newOCSPResponderDesignatedCustomAddress(t, issuerCertPEM, respCertPEM, respKeyPEM, "127.0.0.1:18888")
+}
+
+func newOCSPResponderIntermediateCA1Undelegated(t *testing.T) *http.Server {
+	t.Helper()
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem"
+	issuerCertKey := "configs/certs/ocsp_peer/mini-ca/intermediate1/private/intermediate1_keypair.pem"
+	return newOCSPResponderCustomAddress(t, issuerCertPEM, issuerCertKey, "127.0.0.1:18888")
+}
+
+func newOCSPResponderBadDelegateIntermediateCA1(t *testing.T) *http.Server {
+	t.Helper()
+	// UserA2 is a cert issued by intermediate1, but intermediate1 did not add OCSP signing extension
+	respCertPEM := "configs/certs/ocsp_peer/mini-ca/client1/UserA2_bundle.pem"
+	respKeyPEM := "configs/certs/ocsp_peer/mini-ca/client1/private/UserA2_keypair.pem"
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem"
+	return newOCSPResponderDesignatedCustomAddress(t, issuerCertPEM, respCertPEM, respKeyPEM, "127.0.0.1:18888")
+}
+
+func newOCSPResponderIntermediateCA2(t *testing.T) *http.Server {
+	t.Helper()
+	respCertPEM := "configs/certs/ocsp_peer/mini-ca/ocsp2/ocsp2_bundle.pem"
+	respKeyPEM := "configs/certs/ocsp_peer/mini-ca/ocsp2/private/ocsp2_keypair.pem"
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem"
+	return newOCSPResponderDesignatedCustomAddress(t, issuerCertPEM, respCertPEM, respKeyPEM, "127.0.0.1:28888")
+}
+
+// TestOCSPPeerGoodClients is test of two NATS client (AIA enabled at leaf and cert) under good path (different intermediates)
+// and default ocsp_cache implementation and oscp_cache=false configuration
+func TestOCSPPeerGoodClients(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Default cache: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			`
+				port: -1
+				# default ocsp_cache since omitted
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration, non-default ca_timeout
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"Default cache: mTLS OCSP peer check on inbound client connection, client of intermediate CA 2",
+			`
+				port: -1
+				# default ocsp_cache since omitted
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"Explicit true cache: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			`
+				port: -1
+				# Short form configuration
+				ocsp_cache: true
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+			nc.Subscribe("ping", func(m *nats.Msg) {
+				m.Respond([]byte("pong"))
+			})
+			nc.Flush()
+			_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			if test.rerr != nil && err == nil {
+				t.Errorf("Expected error getting response")
+			} else if test.rerr == nil && err != nil {
+				t.Errorf("Expected response")
+			}
+		})
+	}
+}
+
+// TestOCSPPeerUnknownClient is test of NATS client that is OCSP status Unknown from its OCSP Responder
+func TestOCSPPeerUnknownClient(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	defer intermediateCA1Responder.Shutdown(ctx)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Default cache, mTLS OCSP peer check on inbound client connection, client unknown to intermediate CA 1",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+
+			t.Errorf("Expected connection error, fell through")
+		})
+	}
+}
+
+// TestOCSPPeerRevokedClient is test of NATS client that is OCSP status Revoked from its OCSP Responder
+func TestOCSPPeerRevokedClient(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Revoked)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"mTLS OCSP peer check on inbound client connection, client revoked by intermediate CA 1",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so this revoked client should NOT be able to connect
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+		{
+			"Explicit disable, mTLS OCSP peer check on inbound client connection, client revoked by intermediate CA 1 but no OCSP check",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Explicit disable of OCSP peer check
+					ocsp_peer: false
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"Implicit disable, mTLS OCSP peer check on inbound client connection, client revoked by intermediate CA 1 but no OCSP check",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Implicit disable of OCSP peer check (i.e. not configured)
+					# ocsp_peer: false
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"Explicit disable (long form), mTLS OCSP peer check on inbound client connection, client revoked by intermediate CA 1 but no OCSP check",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Explicit disable of OCSP peer check, long form
+					ocsp_peer: { verify: false }
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerUnknownAndRevokedIntermediate test of NATS client that is OCSP good but either its intermediate is unknown or revoked
+func TestOCSPPeerUnknownAndRevokedIntermediate(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Revoked)
+	// No test OCSP status set on intermediate2, so unknown
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"mTLS OCSP peer check on inbound client connection, client's intermediate is revoked",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+		{
+			"mTLS OCSP peer check on inbound client connection, client's intermediate is unknown'",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+
+			t.Errorf("Expected connection error, fell through")
+		})
+	}
+}
+
+// TestOCSPPeerLeafGood tests Leaf Spoke peer checking Leaf Hub, Leaf Hub peer checking Leaf Spoke, and both peer checking
+func TestOCSPPeerLeafGood(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name        string
+		hubconfig   string
+		spokeconfig string
+		expected    int
+	}{
+		{
+			"OCSP peer check on Leaf Hub by Leaf Spoke (TLS client OCSP verification of TLS server)",
+			`
+				port: -1
+				# Cache configuration is default
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Short form configuration
+								ocsp_peer: true
+							}
+						}
+					]
+				}
+			`,
+			1,
+		},
+		{
+			"OCSP peer check on Leaf Spoke by Leaf Hub (TLS server OCSP verification of TLS client)",
+			`
+				port: -1
+				# Cache configuration is default
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Short form configuration
+						ocsp_peer: true
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+							}
+						}
+					]
+				}
+			`,
+			1,
+		},
+		{
+			"OCSP peer check bi-directionally",
+			`
+				port: -1
+				# Cache configuration is default
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Short form configuration
+						ocsp_peer: true
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Short form configuration
+								ocsp_peer: true
+							}
+						}
+					]
+				}
+			`,
+			1,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			hubcontent := test.hubconfig
+			hubconf := createConfFile(t, []byte(hubcontent))
+			hub, _ := RunServerWithConfig(hubconf)
+			defer hub.Shutdown()
+
+			spokecontent := test.spokeconfig
+			spokeconf := createConfFile(t, []byte(spokecontent))
+			spoke, _ := RunServerWithConfig(spokeconf)
+			defer spoke.Shutdown()
+
+			checkLeafNodeConnectedCount(t, hub, test.expected)
+		})
+	}
+}
+
+// TestOCSPPeerLeafRejects tests rejected Leaf Hub, rejected Leaf Spoke, and both rejecting each other
+func TestOCSPPeerLeafReject(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Revoked)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem", ocsp.Revoked)
+
+	for _, test := range []struct {
+		name        string
+		hubconfig   string
+		spokeconfig string
+		expected    int
+	}{
+		{
+			"OCSP peer check on Leaf Hub by Leaf Spoke (TLS client OCSP verification of TLS server)",
+			`
+				port: -1
+				# Cache configuration is default
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Short form configuration
+								ocsp_peer: true
+							}
+						}
+					]
+				}
+			`,
+			0,
+		},
+		{
+			"OCSP peer check on Leaf Spoke by Leaf Hub (TLS server OCSP verification of TLS client)",
+			`
+				port: -1
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Short form configuration
+						ocsp_peer: true
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+							}
+						}
+					]
+				}
+			`,
+			0,
+		},
+		{
+			"OCSP peer check bi-directionally",
+			`
+				port: -1
+				leaf: {
+					listen: 127.0.0.1:7444
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Short form configuration
+						ocsp_peer: true
+					}
+				}
+			`,
+			`
+				port: -1
+				leaf: {
+					remotes: [
+						{
+							url: "nats://127.0.0.1:7444",
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Short form configuration
+								ocsp_peer: true
+							}
+						}
+					]
+				}
+			`,
+			0,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			hubcontent := test.hubconfig
+			hubconf := createConfFile(t, []byte(hubcontent))
+			hub, _ := RunServerWithConfig(hubconf)
+			defer hub.Shutdown()
+			spokecontent := test.spokeconfig
+			spokeconf := createConfFile(t, []byte(spokecontent))
+			spoke, _ := RunServerWithConfig(spokeconf)
+			defer spoke.Shutdown()
+			// Need to inject some time for leaf connection attempts to complete, could refine this to better
+			// negative test
+			time.Sleep(2000 * time.Millisecond)
+			checkLeafNodeConnectedCount(t, hub, test.expected)
+		})
+	}
+}
+
+func checkLeafNodeConnectedCount(t testing.TB, s *server.Server, lnCons int) {
+	t.Helper()
+	checkFor(t, 5*time.Second, 15*time.Millisecond, func() error {
+		if nln := s.NumLeafNodes(); nln != lnCons {
+			return fmt.Errorf("expected %d connected leafnode(s) for server %q, got %d",
+				lnCons, s.ID(), nln)
+		}
+		return nil
+	})
+}
+
+// TestOCSPPeerGoodClientsNoneCache is test of two NATS client (AIA enabled at leaf and cert) under good path (different intermediates)
+// and ocsp cache type of none (no-op)
+func TestOCSPPeerGoodClientsNoneCache(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	deleteLocalStore(t, "")
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"None cache explicit long form: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			`
+				port: -1
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+				# Long form configuration
+				ocsp_cache: {
+					type: none
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"None cache explicit short form: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			`
+				port: -1
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+				# Short form configuration
+				ocsp_cache: false
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+			nc.Subscribe("ping", func(m *nats.Msg) {
+				m.Respond([]byte("pong"))
+			})
+			nc.Flush()
+			_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			if test.rerr != nil && err == nil {
+				t.Errorf("Expected error getting response")
+			} else if test.rerr == nil && err != nil {
+				t.Errorf("Expected response")
+			}
+		})
+	}
+}
+
+// TestOCSPPeerGoodClientsLocalCache is test of two NATS client (AIA enabled at leaf and cert) under good path (different intermediates)
+// and leveraging the local ocsp cache type
+func TestOCSPPeerGoodClientsLocalCache(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Default cache, short form: mTLS OCSP peer check on inbound client connection, UserA1 client of intermediate CA 1",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+				# Short form configuration, local as default
+				ocsp_cache: true
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+		{
+			"Local cache long form: mTLS OCSP peer check on inbound client connection, UserB1 client of intermediate CA 2",
+			`
+				port: -1
+				http_port: 8222
+
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+				# Long form configuration
+				ocsp_cache: {
+					type: local
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			// Cleanup any previous test that saved a local cache
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			nc.Close()
+
+			v := monitorGetVarzHelper(t, 8222)
+			if v.OCSPResponseCache.Misses != 2 || v.OCSPResponseCache.Responses != 2 {
+				t.Errorf("Expected cache misses and cache items to be 2, got %d and %d", v.OCSPResponseCache.Misses, v.OCSPResponseCache.Responses)
+			}
+
+			// Should get a cache hit now
+			nc, err = nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+			nc.Subscribe("ping", func(m *nats.Msg) {
+				m.Respond([]byte("pong"))
+			})
+			nc.Flush()
+			_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			if test.rerr != nil && err == nil {
+				t.Errorf("Expected error getting response")
+			} else if test.rerr == nil && err != nil {
+				t.Errorf("Expected response")
+			}
+
+			v = monitorGetVarzHelper(t, 8222)
+			if v.OCSPResponseCache.Misses != 2 || v.OCSPResponseCache.Hits != 2 || v.OCSPResponseCache.Responses != 2 {
+				t.Errorf("Expected cache misses, hits and cache items to be 2, got %d and %d and %d", v.OCSPResponseCache.Misses, v.OCSPResponseCache.Hits, v.OCSPResponseCache.Responses)
+			}
+		})
+	}
+}
+
+func TestOCSPPeerMonitor(t *testing.T) {
+	for _, test := range []struct {
+		name               string
+		config             string
+		NATSClient         bool
+		WSClient           bool
+		MQTTClient         bool
+		LeafClient         bool
+		LeafRemotes        bool
+		NumTrueLeafRemotes int
+	}{
+		{
+			"Monitor peer config setting on NATS client",
+			`
+				port: -1
+				http_port: 8222
+				# Default cache configuration
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+			`,
+			true,
+			false,
+			false,
+			false,
+			false,
+			0,
+		},
+		{
+			"Monitor peer config setting on Websockets client",
+			`
+				port: -1
+				http_port: 8222
+				# Default cache configuration
+				websocket: {
+					port: 8443
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Long form configuration
+						ocsp_peer: {
+							verify: true
+						}
+					}
+				}
+			`,
+			false,
+			true,
+			false,
+			false,
+			false,
+			0,
+		},
+		{
+			"Monitor peer config setting on MQTT client",
+			`
+				port: -1
+				http_port: 8222
+				# Default cache configuration
+				# Required for MQTT
+				server_name: "my_mqtt_server"
+				jetstream: {
+					enabled: true
+				}
+				mqtt: {
+					port: 1883
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Long form configuration
+						ocsp_peer: {
+							verify: true
+						}
+					}
+				}
+			`,
+			false,
+			false,
+			true,
+			false,
+			false,
+			0,
+		},
+		{
+			"Monitor peer config setting on Leaf client",
+			`
+				port: -1
+				http_port: 8222
+				# Default cache configuration
+				leaf: {
+					port: 7422
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Long form configuration
+						ocsp_peer: {
+							verify: true
+						}
+					}
+				}
+			`,
+			false,
+			false,
+			false,
+			true,
+			false,
+			0,
+		},
+		{
+			"Monitor peer config on some Leaf Remotes as well as Leaf client",
+			`
+				port: -1
+				http_port: 8222
+				# Default cache configuration
+				leaf: {
+					port: 7422
+					tls: {
+						cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+						key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+						ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+						timeout: 5
+						verify: true
+						# Long form configuration
+						ocsp_peer: {
+							verify: true
+						}
+					}
+					remotes: [
+						{
+							url: "nats-leaf://bogus:7422"
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Long form configuration
+								ocsp_peer: {
+									verify: true
+								}
+							}
+						},
+						{
+							url: "nats-leaf://anotherbogus:7422"
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Short form configuration
+								ocsp_peer: true
+							}
+						},
+						{
+							url: "nats-leaf://yetanotherbogus:7422"
+							tls: {
+								cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+								key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+								ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+								timeout: 5
+								# Peer not configured (default false)
+							}
+						}
+					]
+				}
+			`,
+			false,
+			false,
+			false,
+			true,
+			true,
+			2,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, _ := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			v := monitorGetVarzHelper(t, 8222)
+			if test.NATSClient {
+				if !v.TLSOCSPPeerVerify {
+					t.Fatalf("Expected NATS Client TLSOCSPPeerVerify to be true, got false")
+				}
+			}
+			if test.WSClient {
+				if !v.Websocket.TLSOCSPPeerVerify {
+					t.Fatalf("Expected WS Client TLSOCSPPeerVerify to be true, got false")
+				}
+			}
+			if test.LeafClient {
+				if !v.LeafNode.TLSOCSPPeerVerify {
+					t.Fatalf("Expected Leaf Client TLSOCSPPeerVerify to be true, got false")
+				}
+			}
+			if test.LeafRemotes {
+				cnt := 0
+				for _, r := range v.LeafNode.Remotes {
+					if r.TLSOCSPPeerVerify {
+						cnt++
+					}
+				}
+				if cnt != test.NumTrueLeafRemotes {
+					t.Fatalf("Expected %d Leaf Remotes with TLSOCSPPeerVerify true, got %d", test.NumTrueLeafRemotes, cnt)
+				}
+			}
+		})
+	}
+}
+
+func TestOCSPResponseCacheMonitor(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		config string
+		expect string
+	}{
+		{
+			"Monitor local cache enabled, explicit cache true",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+				# Short form configuration
+				ocsp_cache: true
+			`,
+			"local",
+		},
+		{
+			"Monitor local cache enabled, explicit cache type local",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+				# Long form configuration
+				ocsp_cache: {
+					type: local
+				}
+			`,
+			"local",
+		},
+		{
+			"Monitor local cache enabled, implicit default",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+				# Short form configuration
+				# ocsp_cache: true
+			`,
+			"local",
+		},
+		{
+			"Monitor none cache enabled, explicit cache false (short)",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+				# Short form configuration
+				ocsp_cache: false
+			`,
+			"",
+		},
+		{
+			"Monitor none cache enabled, explicit cache false (long)",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+					}
+				}
+				# Long form configuration
+				ocsp_cache: {
+					type: none
+				}
+			`,
+			"",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, _ := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			v := monitorGetVarzHelper(t, 8222)
+			if v.OCSPResponseCache.Type != test.expect {
+				t.Fatalf("Expected OCSP Response Cache to be %s, got %s", test.expect, v.OCSPResponseCache.Type)
+			}
+		})
+	}
+}
+
+func TestOCSPResponseCacheChangeAndReload(t *testing.T) {
+	deleteLocalStore(t, "")
+
+	// Start with ocsp cache set to none
+	content := `
+		port: -1
+		http_port: 8222
+		tls {
+			cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+			key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+			ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+			timeout: 5
+			verify: true
+			# Short form configuration
+			ocsp_peer: true
+		}
+		# Long form configuration
+		ocsp_cache: {
+			type: none
+		}
+	`
+	conf := createConfFile(t, []byte(content))
+	s, _ := RunServerWithConfig(conf)
+	defer s.Shutdown()
+	v := monitorGetVarzHelper(t, 8222)
+	if v.OCSPResponseCache.Type != "" {
+		t.Fatalf("Expected OCSP Response Cache to have empty type in varz indicating none")
+	}
+
+	// Change to local cache
+	content = `
+		port: -1
+		http_port: 8222
+		tls {
+			cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+			key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+			ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+			timeout: 5
+			verify: true
+			# Short form configuration
+			ocsp_peer: true
+		}
+		# Long form configuration
+		ocsp_cache: {
+			type: local
+		}
+	`
+	if err := os.WriteFile(conf, []byte(content), 0666); err != nil {
+		t.Fatalf("Error writing config: %v", err)
+	}
+	if err := s.Reload(); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(2 * time.Second)
+	v = monitorGetVarzHelper(t, 8222)
+	if v.OCSPResponseCache.Type != "local" {
+		t.Fatalf("Expected OCSP Response Cache type to be local, got %q", v.OCSPResponseCache.Type)
+	}
+}
+
+func deleteLocalStore(t *testing.T, dir string) {
+	t.Helper()
+	if dir == "" {
+		// default
+		dir = "_rc_"
+	}
+	if err := os.RemoveAll(dir); err != nil {
+		t.Fatalf("Error cleaning up local store: %v", err)
+	}
+}
+
+func monitorGetVarzHelper(t *testing.T, httpPort int) *server.Varz {
+	t.Helper()
+	url := fmt.Sprintf("http://127.0.0.1:%d/", httpPort)
+	resp, err := http.Get(url + "varz")
+	if err != nil {
+		t.Fatalf("Expected no error: Got %v\n", err)
+	}
+	if resp.StatusCode != 200 {
+		t.Fatalf("Expected a 200 response, got %d\n", resp.StatusCode)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("Got an error reading the body: %v\n", err)
+	}
+	v := server.Varz{}
+	if err := json.Unmarshal(body, &v); err != nil {
+		t.Fatalf("Got an error unmarshalling the body: %v\n", err)
+	}
+	return &v
+}
+
+func writeCacheFile(dir string, content []byte) error {
+	if dir == "" {
+		dir = "_rc_"
+	}
+	err := os.MkdirAll(filepath.Join(dir), os.ModePerm)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(dir, "cache.json"), content, os.ModePerm)
+}
+
+// TestOCSPPeerPreserveRevokedCacheItem is test of the preserve_revoked cache policy
+func TestOCSPPeerPreserveRevokedCacheItem(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		responses int64
+		revokes   int64
+		goods     int64
+		unknowns  int64
+		err       error
+		rerr      error
+		clean     bool
+	}{
+		{
+			"Test expired revoked cert not actually deleted",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so this revoked client should NOT be able to connect
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			1,
+			1,
+			0,
+			0,
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			true,
+		},
+		{
+			"Test expired revoked cert replaced by current good cert",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so this revoked client should NOT be able to connect
+					ocsp_peer: true
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			2,
+			0,
+			2,
+			0,
+			nil,
+			nil,
+			false,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var intermediateCA1Responder *http.Server
+			// clean slate starting the test and start the leaf CA responder for first run
+			if test.clean {
+				deleteLocalStore(t, "")
+				// establish the revoked item (expired) in cache
+				c := []byte(`
+				{
+				 "5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+				  "subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+				  "cached_at": "2023-05-29T17:56:45Z",
+				  "resp_status": "revoked",
+				  "resp_expires": "2023-05-29T17:56:49Z",
+				  "resp": "/wYAAFMyc1R3TwBSBQBao1Qr1QzUMIIGUQoBAKCCBkowggZGBgkrBgEFBQcwAQEEggY3MIIGMzCB46FZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HQDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA1MjkxNzU2MDBaMHUwczBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBc2ZAAQNDVaoBE2dwD0QQE0OVowDQYJKoZIhvcNAQELBQADggEBAGAax/vkv3SBFNbxp2utc/N6Rje4E0ceC972sWgqYjzYrH0oc/acg+OAXaxUjwqoQWaT+dHaI4D5qoTkMx7XlWATjI2L72IUTf6Luo92jPzyDFwb10CdeFHtRtEYD54Qbi/nD4oxQ8cSoLKC3wft2l3E/mK/1I4Mxwq15CioK4MhfzTISoeGZbjDXPKgloJOG3rn9v64vFGV6dosbLgaXEs+MPcCsPQYkwhOOyazuewRmIDOBp5QSsKPhqsT8Rs20t8LGTMkvjZniFWJs90l9QL9F1m3obq5nyuxrGt+7Rf5zoj4T+0XCOGtE+b7cRCLg43tFuTbaAQG8Z+qkPzpza+gggQ1MIIEMTCCBC0wggMVoAMCAQICFCnhUo39pSqH6x3kHUds4YpYaXOrOj8BBDBaUSLaLwIIGjAYSS+oEUludGVybWVkaWF0ZSBDQSAxMB4XDTIzMDUwMTE5MjgzOVoXDTMzMDQyOA0PUasVAEkMMIIBIi4nAgABBQD0QAEPADCCAQoCggEBAKMMyuuA66EOHnGb07P5Zc5wwiEGPDHBBn6lqErhIaN0VJ9XzlDWwyk8Q7CdPlSU7o36DXFs316eATB5bLuXXa+7WwV3cp9V5mZF9OLCz3sOWNYUanYprOMwKA3uvcqqrh8e70Dzw6sX8tfsDeH7aJoJg5kRWEKU+A3Umm+fO+hW8Km3GBqRQXxD49uxAfGtCznXZZjmFbAXqVZu+4R6wMxndfz2dYQxeMVtUY/QGdMWT4fvWzO5et3+X6hq/URUAPOkplv9O2U4T4JPucS9yZpW/FTxWC/L7vQI/bfsrSgIZpv4eJgy27FW3Q4xusbjVvUCL/t2KLvEi/Nr2qodOCECAwEAAaOB7TCB6jAdBgNVHQ4EFgQUy15QYHqrL6k7HiSrAkKN7IFgSBMwHwYDVR0jBBgwFoBSyQNQMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQ4YBAMCB4AwFgEeACUBEBAMMAoGCIm0sAMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4ODgvaV1WKDFfY3JsLmRlcjAzEUscAQEEJzAlMCMRWwwwAYYXWkoALhICkTnw/0hlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+				 }
+				}`)
+				err := writeCacheFile("", c)
+				if err != nil {
+					t.Fatal(err)
+				}
+			} else {
+				intermediateCA1Responder = newOCSPResponderIntermediateCA1(t)
+				intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+				setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+				defer intermediateCA1Responder.Shutdown(ctx)
+			}
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+			v := monitorGetVarzHelper(t, 8222)
+			responses := v.OCSPResponseCache.Responses
+			revokes := v.OCSPResponseCache.Revokes
+			goods := v.OCSPResponseCache.Goods
+			unknowns := v.OCSPResponseCache.Unknowns
+			if !(responses == test.responses && revokes == test.revokes && goods == test.goods && unknowns == test.unknowns) {
+				t.Fatalf("Expected %d response, %d revoked, %d good, %d unknown; got [%d] and [%d] and [%d] and [%d]", test.responses, test.revokes, test.goods, test.unknowns, responses, revokes, goods, unknowns)
+			}
+		})
+	}
+}
+
+// TestOCSPStapleFeatureInterop is a test of a NATS client (AIA enabled at leaf and cert) connecting to a NATS Server
+// in which both ocsp_peer is enabled on NATS client connections (verify client) and the ocsp staple is enabled such
+// that the NATS Server will staple its own OCSP response and make available to the NATS client during handshake.
+func TestOCSPStapleFeatureInterop(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Interop: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			`
+				port: -1
+				ocsp_cache: true
+				ocsp: {
+					mode: always
+				}
+				tls: {
+					# cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration, non-default ca_timeout
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			// TODO(tgb) - come back to this test after fixing OCSP Staple issue https://github.com/nats-io/nats-server/issues/3773
+			//deleteLocalStore(t, "")
+			//test.configure()
+			//content := test.config
+			//conf := createConfFile(t, []byte(content))
+			//
+			//s, opts := RunServerWithConfig(conf)
+			//defer s.Shutdown()
+			//nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			//if test.err == nil && err != nil {
+			//	t.Errorf("Expected to connect, got %v", err)
+			//} else if test.err != nil && err == nil {
+			//	t.Errorf("Expected error on connect")
+			//} else if test.err != nil && err != nil {
+			//	// Error on connect was expected
+			//	if test.err.Error() != err.Error() {
+			//		t.Errorf("Expected error %s, got: %s", test.err, err)
+			//	}
+			//	return
+			//}
+			//defer nc.Close()
+			//nc.Subscribe("ping", func(m *nats.Msg) {
+			//	m.Respond([]byte("pong"))
+			//})
+			//nc.Flush()
+			//_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			//if test.rerr != nil && err == nil {
+			//	t.Errorf("Expected error getting response")
+			//} else if test.rerr == nil && err != nil {
+			//	t.Errorf("Expected response")
+			//}
+		})
+	}
+}
+
+// TestOCSPPeerWarnOnlyOption is test of NATS client that is OCSP Revoked status but allowed to pass with warn_only option
+func TestOCSPPeerWarnOnlyOption(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Revoked)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Revoked NATS client with warn_only explicitly set to false",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Enable OCSP peer but with warn_only option set to false
+					ocsp_peer: {
+						verify: true
+						warn_only: false
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+		{
+			"Revoked NATS client with warn_only explicitly set to true",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Enable OCSP peer but with warn_only option set to true
+					ocsp_peer: {
+						verify: true
+						warn_only: true
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerUnknownIsGoodOption is test of NATS client that is OCSP status Unknown from its OCSP Responder but we treat
+// status Unknown as "Good"
+func TestOCSPPeerUnknownIsGoodOption(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	defer intermediateCA1Responder.Shutdown(ctx)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Unknown NATS client with no unknown_is_good option set (default false)",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Short form configuration
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+		{
+			"Unknown NATS client with unknown_is_good set to true",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						unknown_is_good: true
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerAllowWhenCAUnreachableOption is test of the allow_when_ca_unreachable peer option
+func TestOCSPPeerAllowWhenCAUnreachableOption(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name           string
+		config         string
+		opts           []nats.Option
+		cachedResponse string
+		err            error
+		rerr           error
+	}{
+		{
+			"Expired Revoked response in cache for UserA1 -- should be rejected connection (expired revoke honored)",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			`
+				{
+					"5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+						"subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+						"cached_at": "2023-05-29T17:56:45Z",
+						"resp_status": "revoked",
+						"resp_expires": "2023-05-29T17:56:49Z",
+						"resp": "/wYAAFMyc1R3TwBSBQBao1Qr1QzUMIIGUQoBAKCCBkowggZGBgkrBgEFBQcwAQEEggY3MIIGMzCB46FZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HQDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA1MjkxNzU2MDBaMHUwczBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBc2ZAAQNDVaoBE2dwD0QQE0OVowDQYJKoZIhvcNAQELBQADggEBAGAax/vkv3SBFNbxp2utc/N6Rje4E0ceC972sWgqYjzYrH0oc/acg+OAXaxUjwqoQWaT+dHaI4D5qoTkMx7XlWATjI2L72IUTf6Luo92jPzyDFwb10CdeFHtRtEYD54Qbi/nD4oxQ8cSoLKC3wft2l3E/mK/1I4Mxwq15CioK4MhfzTISoeGZbjDXPKgloJOG3rn9v64vFGV6dosbLgaXEs+MPcCsPQYkwhOOyazuewRmIDOBp5QSsKPhqsT8Rs20t8LGTMkvjZniFWJs90l9QL9F1m3obq5nyuxrGt+7Rf5zoj4T+0XCOGtE+b7cRCLg43tFuTbaAQG8Z+qkPzpza+gggQ1MIIEMTCCBC0wggMVoAMCAQICFCnhUo39pSqH6x3kHUds4YpYaXOrOj8BBDBaUSLaLwIIGjAYSS+oEUludGVybWVkaWF0ZSBDQSAxMB4XDTIzMDUwMTE5MjgzOVoXDTMzMDQyOA0PUasVAEkMMIIBIi4nAgABBQD0QAEPADCCAQoCggEBAKMMyuuA66EOHnGb07P5Zc5wwiEGPDHBBn6lqErhIaN0VJ9XzlDWwyk8Q7CdPlSU7o36DXFs316eATB5bLuXXa+7WwV3cp9V5mZF9OLCz3sOWNYUanYprOMwKA3uvcqqrh8e70Dzw6sX8tfsDeH7aJoJg5kRWEKU+A3Umm+fO+hW8Km3GBqRQXxD49uxAfGtCznXZZjmFbAXqVZu+4R6wMxndfz2dYQxeMVtUY/QGdMWT4fvWzO5et3+X6hq/URUAPOkplv9O2U4T4JPucS9yZpW/FTxWC/L7vQI/bfsrSgIZpv4eJgy27FW3Q4xusbjVvUCL/t2KLvEi/Nr2qodOCECAwEAAaOB7TCB6jAdBgNVHQ4EFgQUy15QYHqrL6k7HiSrAkKN7IFgSBMwHwYDVR0jBBgwFoBSyQNQMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQ4YBAMCB4AwFgEeACUBEBAMMAoGCIm0sAMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4ODgvaV1WKDFfY3JsLmRlcjAzEUscAQEEJzAlMCMRWwwwAYYXWkoALhICkTnw/0hlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+					}
+				}`,
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+		},
+		{
+			"Expired Good response in cache for UserA1 -- should be allowed connection (cached item irrelevant)",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			`
+			{
+				"5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+					"subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+					"cached_at": "2023-06-05T16:33:52Z",
+					"resp_status": "good",
+					"resp_expires": "2023-06-05T16:33:55Z",
+					"resp": "/wYAAFMyc1R3TwBYBQBgpzMn1wzUMIIGUwoBAKCCBkwwggZIBgkrBgEFBQcwAQEEggY5MIIGNTCB5aFZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HYDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA2MDUxNjMzMDBaMHcwdTBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBeAADZmABA1MVqgEToTAPRAATVaMA0GCSqGSIb3DQEBCwUAA4IBAQB9csJxA2VcpQYmC5lzI0dJJnEC1zcaP1oFbBm5VsZAbWh4mIGTqyEjMkucBqANTypnhWFRYcZE5nJE8tN8Aen0EBYkhk1wfEIhincaF3zs6x5RzigxQOqTPAanO55keKH5exYnfBcyCwAQiBbQaTXLJJdjerfqiRjqgsnLW8yl2IC8+kxTCfR4GHTK34mvqVWYYhP/xbaxTLJTp35t1vf1o78ct9R+z8W5sCSO4TsMNnExZlu4Ejeon/KivMR22j7nelTEaDCuaOl03WxKh9yhw2ix8V7lvR74wh5f4fjLZria6Y0+lUjwvvrZyBRwA62W/ihe3778q8KhLECFPQSaoIIENTCCBDEwggQtMIIDFaADAgECAhQp4VKN/aUqh+sd5B1HbOGKWGlzqzo/AQQwWlEk2jECCBowGEkxqBFJbnRlcm1lZGlhdGUgQ0EgMTAeFw0yMzA1MDExOTI4MzlaFw0zMzA0MjgND1GtFQBJDDCCASIuJwIAAQUA9EABDwAwggEKAoIBAQCjDMrrgOuhDh5xm9Oz+WXOcMIhBjwxwQZ+pahK4SGjdFSfV85Q1sMpPEOwnT5UlO6N+g1xbN9engEweWy7l12vu1sFd3KfVeZmRfTiws97DljWFGp2KazjMCgN7r3Kqq4fHu9A88OrF/LX7A3h+2iaCYOZEVhClPgN1JpvnzvoVvCptxgakUF8Q+PbsQHxrQs512WY5hWwF6lWbvuEesDMZ3X89nWEMXjFbVGP0BnTFk+H71szuXrd/l+oav1EVADzpKZb/TtlOE+CT7nEvcmaVvxU8Vgvy+70CP237K0oCGab+HiYMtuxVt0OMbrG41b1Ai/7dii7xIvza9qqHTghAgMBAAGjge0wgeowHQYDVR0OBBYEFMteUGB6qy+pOx4kqwJCjeyBYEgTMB8GA1UdIwQYMBaAUssDUDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEOGAQDAgeAMBYBHgAlARAQDDAKBgiJtrADCTA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ldVigxX2NybC5kZXIwMxFLHAEBBCcwJTAjEVsMMAGGF1pKAC4SAgALBQD0AQEBAEhlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+				}
+			}`,
+			nil,
+			nil,
+		},
+		{
+			"Expired Unknown response in cache for UserA1 -- should be allowed connection (cached item irrelevant)",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			`
+			{
+				"5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+					"subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+					"cached_at": "2023-06-05T16:45:01Z",
+					"resp_status": "unknown",
+					"resp_expires": "2023-06-05T16:45:05Z",
+					"resp": "/wYAAFMyc1R3TwBSBQBH1aW01wzUMIIGUwoBAKCCBkwwggZIBgkrBgEFBQcwAQEEggY5MIIGNTCB5aFZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HYDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA2MDUxNjQ1MDBaMHcwdTBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBeCADpmAAwxWqAROhMA9EABNVowDQYJKoZIhvcNAQELBQADggEBAAzwED88ngiFj3hLzIejZ8DE/ppticX0vgAjUM8oXjDjwNXpSQ5xdXHsDk4RAYAVpNyiAfL2fapwz91g3JuZot6npp8smtZC5D0YMKK8iMjrx2aMqVyv+ai/33WG8PRWpBNzSTYaLhlBFjhUrx8HDu97ozNbmfgDWzRS1LqkJRa5YXvkyppqYTFSX73DV9R9tOVOwZ0x5WEKst9IJ+88mXsOBGyuye2Gh9RK6KsLgaOwiD9FBf18WRKIixeVM1Y/xHc/iwFPi8k3Z6hZ6gHX8NboQ/djCyzYVSWsUedTo/62uuagHPRWoYci4HQl4bSFXfcEO/EkWGnqkWBHfYZ4soigggQ1MIIEMTCCBC0wggMVoAMCAQICFCnhUo39pSqH6x3kHUds4YpYaXOrOj8BBDBaUSTaMQIIGjAYSTGoEUludGVybWVkaWF0ZSBDQSAxMB4XDTIzMDUwMTE5MjgzOVoXDTMzMDQyOA0PUa0VAEkMMIIBIi4nAgABBQD0QAEPADCCAQoCggEBAKMMyuuA66EOHnGb07P5Zc5wwiEGPDHBBn6lqErhIaN0VJ9XzlDWwyk8Q7CdPlSU7o36DXFs316eATB5bLuXXa+7WwV3cp9V5mZF9OLCz3sOWNYUanYprOMwKA3uvcqqrh8e70Dzw6sX8tfsDeH7aJoJg5kRWEKU+A3Umm+fO+hW8Km3GBqRQXxD49uxAfGtCznXZZjmFbAXqVZu+4R6wMxndfz2dYQxeMVtUY/QGdMWT4fvWzO5et3+X6hq/URUAPOkplv9O2U4T4JPucS9yZpW/FTxWC/L7vQI/bfsrSgIZpv4eJgy27FW3Q4xusbjVvUCL/t2KLvEi/Nr2qodOCECAwEAAaOB7TCB6jAdBgNVHQ4EFgQUy15QYHqrL6k7HiSrAkKN7IFgSBMwHwYDVR0jBBgwFoBSywNQMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQ4YBAMCB4AwFgEeACUBEBAMMAoGCIm2sAMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4ODgvaV1WKDFfY3JsLmRlcjAzEUscAQEEJzAlMCMRWwwwAYYXWkoALhICkTnw/0hlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+				}
+			}`,
+			nil,
+			nil,
+		},
+		{
+			"No response in cache for UserA1 -- should be allowed connection",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			"",
+			nil,
+			nil,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			c := []byte(test.cachedResponse)
+			err := writeCacheFile("", c)
+			if err != nil {
+				t.Fatal(err)
+			}
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPResponseCacheLocalStoreOption is test of default and non-default local_store option
+func TestOCSPResponseCacheLocalStoreOpt(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name           string
+		config         string
+		opts           []nats.Option
+		cachedResponse string
+		err            error
+		rerr           error
+		storeLocation  string
+	}{
+		{
+			"Test load from non-default local store _custom_; connect will reject only if cache file found and loaded",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					local_store: "_custom_"
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			`
+				{
+					"5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+						"subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+						"cached_at": "2023-05-29T17:56:45Z",
+						"resp_status": "revoked",
+						"resp_expires": "2023-05-29T17:56:49Z",
+						"resp": "/wYAAFMyc1R3TwBSBQBao1Qr1QzUMIIGUQoBAKCCBkowggZGBgkrBgEFBQcwAQEEggY3MIIGMzCB46FZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HQDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA1MjkxNzU2MDBaMHUwczBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBc2ZAAQNDVaoBE2dwD0QQE0OVowDQYJKoZIhvcNAQELBQADggEBAGAax/vkv3SBFNbxp2utc/N6Rje4E0ceC972sWgqYjzYrH0oc/acg+OAXaxUjwqoQWaT+dHaI4D5qoTkMx7XlWATjI2L72IUTf6Luo92jPzyDFwb10CdeFHtRtEYD54Qbi/nD4oxQ8cSoLKC3wft2l3E/mK/1I4Mxwq15CioK4MhfzTISoeGZbjDXPKgloJOG3rn9v64vFGV6dosbLgaXEs+MPcCsPQYkwhOOyazuewRmIDOBp5QSsKPhqsT8Rs20t8LGTMkvjZniFWJs90l9QL9F1m3obq5nyuxrGt+7Rf5zoj4T+0XCOGtE+b7cRCLg43tFuTbaAQG8Z+qkPzpza+gggQ1MIIEMTCCBC0wggMVoAMCAQICFCnhUo39pSqH6x3kHUds4YpYaXOrOj8BBDBaUSLaLwIIGjAYSS+oEUludGVybWVkaWF0ZSBDQSAxMB4XDTIzMDUwMTE5MjgzOVoXDTMzMDQyOA0PUasVAEkMMIIBIi4nAgABBQD0QAEPADCCAQoCggEBAKMMyuuA66EOHnGb07P5Zc5wwiEGPDHBBn6lqErhIaN0VJ9XzlDWwyk8Q7CdPlSU7o36DXFs316eATB5bLuXXa+7WwV3cp9V5mZF9OLCz3sOWNYUanYprOMwKA3uvcqqrh8e70Dzw6sX8tfsDeH7aJoJg5kRWEKU+A3Umm+fO+hW8Km3GBqRQXxD49uxAfGtCznXZZjmFbAXqVZu+4R6wMxndfz2dYQxeMVtUY/QGdMWT4fvWzO5et3+X6hq/URUAPOkplv9O2U4T4JPucS9yZpW/FTxWC/L7vQI/bfsrSgIZpv4eJgy27FW3Q4xusbjVvUCL/t2KLvEi/Nr2qodOCECAwEAAaOB7TCB6jAdBgNVHQ4EFgQUy15QYHqrL6k7HiSrAkKN7IFgSBMwHwYDVR0jBBgwFoBSyQNQMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQ4YBAMCB4AwFgEeACUBEBAMMAoGCIm0sAMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4ODgvaV1WKDFfY3JsLmRlcjAzEUscAQEEJzAlMCMRWwwwAYYXWkoALhICkTnw/0hlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+					}
+				}`,
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			"_custom_",
+		},
+		{
+			"Test load from default local store when \"\" set; connect will reject only if cache file found and loaded",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check but allow when CA is unreachable
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 0.5
+						allow_when_ca_unreachable: true
+					}
+				}
+				# preserve revoked true
+				ocsp_cache: {
+					type: local
+					local_store: ""
+					preserve_revoked: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			`
+				{
+					"5xL/SuHl6JN0OmxrNMpzVMTA73JVYcRfGX8+HvJinEI=": {
+						"subject": "CN=UserA1,O=Testnats,L=Tacoma,ST=WA,C=US",
+						"cached_at": "2023-05-29T17:56:45Z",
+						"resp_status": "revoked",
+						"resp_expires": "2023-05-29T17:56:49Z",
+						"resp": "/wYAAFMyc1R3TwBSBQBao1Qr1QzUMIIGUQoBAKCCBkowggZGBgkrBgEFBQcwAQEEggY3MIIGMzCB46FZMFcxCzAJBgNVBAYTAlVTEQ0gCAwCV0ExDzANAQ0wBwwGVGFjb21hMREwDwEROAoMCFRlc3RuYXRzMRcwFQET8HQDDA5PQ1NQIFJlc3BvbmRlchgPMjAyMzA1MjkxNzU2MDBaMHUwczBNMAkGBSsOAwIaBQAEFKgwn5fplwQy+DsulBg5SRpx0iaYBBS1kW5PZLcWhHb5tL6ZzmCVmBqOnQIUXKGv1Xy7Fu/Cx+ZT/JQa7SS7tBc2ZAAQNDVaoBE2dwD0QQE0OVowDQYJKoZIhvcNAQELBQADggEBAGAax/vkv3SBFNbxp2utc/N6Rje4E0ceC972sWgqYjzYrH0oc/acg+OAXaxUjwqoQWaT+dHaI4D5qoTkMx7XlWATjI2L72IUTf6Luo92jPzyDFwb10CdeFHtRtEYD54Qbi/nD4oxQ8cSoLKC3wft2l3E/mK/1I4Mxwq15CioK4MhfzTISoeGZbjDXPKgloJOG3rn9v64vFGV6dosbLgaXEs+MPcCsPQYkwhOOyazuewRmIDOBp5QSsKPhqsT8Rs20t8LGTMkvjZniFWJs90l9QL9F1m3obq5nyuxrGt+7Rf5zoj4T+0XCOGtE+b7cRCLg43tFuTbaAQG8Z+qkPzpza+gggQ1MIIEMTCCBC0wggMVoAMCAQICFCnhUo39pSqH6x3kHUds4YpYaXOrOj8BBDBaUSLaLwIIGjAYSS+oEUludGVybWVkaWF0ZSBDQSAxMB4XDTIzMDUwMTE5MjgzOVoXDTMzMDQyOA0PUasVAEkMMIIBIi4nAgABBQD0QAEPADCCAQoCggEBAKMMyuuA66EOHnGb07P5Zc5wwiEGPDHBBn6lqErhIaN0VJ9XzlDWwyk8Q7CdPlSU7o36DXFs316eATB5bLuXXa+7WwV3cp9V5mZF9OLCz3sOWNYUanYprOMwKA3uvcqqrh8e70Dzw6sX8tfsDeH7aJoJg5kRWEKU+A3Umm+fO+hW8Km3GBqRQXxD49uxAfGtCznXZZjmFbAXqVZu+4R6wMxndfz2dYQxeMVtUY/QGdMWT4fvWzO5et3+X6hq/URUAPOkplv9O2U4T4JPucS9yZpW/FTxWC/L7vQI/bfsrSgIZpv4eJgy27FW3Q4xusbjVvUCL/t2KLvEi/Nr2qodOCECAwEAAaOB7TCB6jAdBgNVHQ4EFgQUy15QYHqrL6k7HiSrAkKN7IFgSBMwHwYDVR0jBBgwFoBSyQNQMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQ4YBAMCB4AwFgEeACUBEBAMMAoGCIm0sAMJMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly8xMjcuMC4wLjE6MTg4ODgvaV1WKDFfY3JsLmRlcjAzEUscAQEEJzAlMCMRWwwwAYYXWkoALhICkTnw/0hlzm2RRjA3tvJ2wELj9e7pMg5GtdWdrLDyI/U1qBxhZoHADbyku7W+R1iL8dFfc4PSmdo+owsygZakvahXjv49xJNX7wV3YMmIHC4lfurIlY2mSnPlu2zEOwEDkI0S9WkTxXmHrkXLSciQJDkwzye6MR5fW+APk4JmKDPc46Go/K1A0EgxY/ugahMYsYtZu++W+IOYbEoYNxoCrcJCHX4c3Ep3t/Wulz4X6DWWhaDkMMUDC2JVE8E/3xUbw0X3adZe9Xf8T+goOz7wLCAigXKj1hvRUmOGISIGelv0KsfluZesG1a1TGLp+W9JX0M9nOaFOvjJTDP96aqIjs8oXGk="
+					}
+				}`,
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			"_rc_",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, test.storeLocation)
+			c := []byte(test.cachedResponse)
+			err := writeCacheFile(test.storeLocation, c)
+			if err != nil {
+				t.Fatal(err)
+			}
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerIncrementalSaveLocalCache is test of timer-based response cache save as new entries added
+func TestOCSPPeerIncrementalSaveLocalCache(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
+
+	var fi os.FileInfo
+	var err error
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      [][]nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"Default cache, short form: mTLS OCSP peer check on inbound client connection, UserA1 client of intermediate CA 1",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+				# Local cache with custom save_interval for testability
+				ocsp_cache: {
+					type: local
+					# Save if dirty ever 1 second
+					save_interval: 1
+				}
+			`,
+			[][]nats.Option{
+				{
+					nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+					nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+					nats.ErrorHandler(noOpErrHandler),
+				},
+				{
+					nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client2/UserB1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client2/private/UserB1_keypair.pem"),
+					nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+					nats.ErrorHandler(noOpErrHandler),
+				},
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			// Cleanup any previous test that saved a local cache
+			deleteLocalStore(t, "")
+			fi, err = statCacheFile("")
+			if err != nil && fi != nil && fi.Size() != 0 {
+				t.Fatalf("Expected no local cache file, got a FileInfo with size %d", fi.Size())
+			}
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+
+			// Connect with UserA1 client and get a CA Response
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts[0]...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			nc.Close()
+			time.Sleep(2 * time.Second)
+			fi, err = statCacheFile("")
+			if err == nil && fi != nil && fi.Size() > 0 {
+				// good
+			} else {
+				if err != nil {
+					t.Fatalf("Expected an extant local cache file, got error: %v", err)
+				}
+				if fi != nil {
+					t.Fatalf("Expected non-zero size local cache file, got a FileInfo with size %d", fi.Size())
+				}
+			}
+			firstFi := fi
+			// Connect with UserB1 client and get another CA Response
+			nc, err = nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts[1]...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			nc.Close()
+			time.Sleep(2 * time.Second)
+			fi, err = statCacheFile("")
+			if err == nil && fi != nil && fi.Size() > firstFi.Size() {
+				// good
+			} else {
+				if err != nil {
+					t.Fatalf("Expected an extant local cache file, got error: %v", err)
+				}
+				if fi != nil {
+					t.Fatalf("Expected non-zero size local cache file with more bytes, got a FileInfo with size %d", fi.Size())
+				}
+			}
+		})
+	}
+}
+
+func statCacheFile(dir string) (os.FileInfo, error) {
+	if dir == "" {
+		dir = "_rc_"
+	}
+	return os.Stat(filepath.Join(dir, "cache.json"))
+}
+
+// TestOCSPPeerUndelegatedCAResponseSigner
+func TestOCSPPeerUndelegatedCAResponseSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1Undelegated(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"mTLS OCSP peer check on inbound client connection, responder is CA (undelegated)",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so unvalidated clients can't connect
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerDelegatedCAResponseSigner
+func TestOCSPPeerDelegatedCAResponseSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"mTLS OCSP peer check on inbound client connection, responder is CA (undelegated)",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so unvalidated clients can't connect
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerBadDelegatedCAResponseSigner
+func TestOCSPPeerBadDelegatedCAResponseSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	intermediateCA1Responder := newOCSPResponderBadDelegateIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name      string
+		config    string
+		opts      []nats.Option
+		err       error
+		rerr      error
+		configure func()
+	}{
+		{
+			"mTLS OCSP peer check on inbound client connection, responder is not a legal delegate",
+			`
+				port: -1
+				# Cache configuration is default
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Turn on CA OCSP check so unvalidated clients can't connect
+					ocsp_peer: true
+				}
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			errors.New("remote error: tls: bad certificate"),
+			errors.New("expect error"),
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+		})
+	}
+}
+
+// TestOCSPPeerNextUpdateUnset is test of scenario when responder does not set NextUpdate and cache TTL option is used
+func TestOCSPPeerNextUpdateUnset(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	rootCAResponder := newOCSPResponderRootCA(t)
+	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
+	defer rootCAResponder.Shutdown(ctx)
+	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
+
+	respCertPEM := "configs/certs/ocsp_peer/mini-ca/ocsp1/ocsp1_bundle.pem"
+	respKeyPEM := "configs/certs/ocsp_peer/mini-ca/ocsp1/private/ocsp1_keypair.pem"
+	issuerCertPEM := "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem"
+	intermediateCA1Responder := newOCSPResponderBase(t, issuerCertPEM, respCertPEM, respKeyPEM, true, "127.0.0.1:18888", 0)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+
+	for _, test := range []struct {
+		name           string
+		config         string
+		opts           []nats.Option
+		err            error
+		rerr           error
+		expectedMisses int64
+		configure      func()
+	}{
+		{
+			"TTL set to 4 seconds with second client connection leveraging cache from first client connect",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 0
+						cache_ttl_when_next_update_unset: 4
+					}
+				}
+				# Short form configuration, local as default
+				ocsp_cache: true
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			2,
+			func() {},
+		},
+		{
+			"TTL set to 1 seconds with second client connection not leveraging cache items from first client connect",
+			`
+				port: -1
+				http_port: 8222
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 0
+						cache_ttl_when_next_update_unset: 1
+					}
+				}
+				# Short form configuration, local as default
+				ocsp_cache: true
+			`,
+			[]nats.Option{
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			3,
+			func() {},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			// Cleanup any previous test that saved a local cache
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			nc.Close()
+
+			// Wait interval shorter than first test, and longer than second test
+			time.Sleep(2 * time.Second)
+
+			nc, err = nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+
+			v := monitorGetVarzHelper(t, 8222)
+			if v.OCSPResponseCache.Misses != test.expectedMisses || v.OCSPResponseCache.Responses != 2 {
+				t.Errorf("Expected cache misses to be %d and cache items to be 2, got %d and %d", test.expectedMisses, v.OCSPResponseCache.Misses, v.OCSPResponseCache.Responses)
+			}
+		})
+	}
+}
diff --git a/test/ocsp_test.go b/test/ocsp_test.go
index c1d2a542..3ff0cd16 100644
--- a/test/ocsp_test.go
+++ b/test/ocsp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The NATS Authors
+// Copyright 2021-2023 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -16,7 +16,7 @@ package test
 import (
 	"bytes"
 	"context"
-	"crypto/rsa"
+	"crypto"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
@@ -32,9 +32,15 @@ import (
 	"testing"
 	"time"
 
+	"golang.org/x/crypto/ocsp"
+
 	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nats.go"
-	"golang.org/x/crypto/ocsp"
+)
+
+const (
+	defaultResponseTTL = 4 * time.Second
+	defaultAddress     = "127.0.0.1:8888"
 )
 
 func TestOCSPAlwaysMustStapleAndShutdown(t *testing.T) {
@@ -2298,7 +2304,7 @@ func TestOCSPGatewayIntermediate(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	ocspr := newOCSPResponderDesignated(t, caCert, caIntermCert, caIntermKey, true)
+	ocspr := newOCSPResponderDesignated(t, caCert, caIntermCert, caIntermKey)
 	defer ocspr.Shutdown(ctx)
 
 	addr := fmt.Sprintf("http://%s", ocspr.Addr)
@@ -2857,12 +2863,27 @@ func TestOCSPCustomConfigReloadEnable(t *testing.T) {
 	nc.Close()
 }
 
-func newOCSPResponder(t *testing.T, issuerCertPEM, issuerKeyPEM string) *http.Server {
+func newOCSPResponderCustomAddress(t *testing.T, issuerCertPEM, issuerKeyPEM string, addr string) *http.Server {
 	t.Helper()
-	return newOCSPResponderDesignated(t, issuerCertPEM, issuerCertPEM, issuerKeyPEM, false)
+	return newOCSPResponderBase(t, issuerCertPEM, issuerCertPEM, issuerKeyPEM, false, addr, defaultResponseTTL)
 }
 
-func newOCSPResponderDesignated(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string, embed bool) *http.Server {
+func newOCSPResponder(t *testing.T, issuerCertPEM, issuerKeyPEM string) *http.Server {
+	t.Helper()
+	return newOCSPResponderBase(t, issuerCertPEM, issuerCertPEM, issuerKeyPEM, false, defaultAddress, defaultResponseTTL)
+}
+
+func newOCSPResponderDesignated(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string) *http.Server {
+	t.Helper()
+	return newOCSPResponderBase(t, issuerCertPEM, respCertPEM, respKeyPEM, true, defaultAddress, defaultResponseTTL)
+}
+
+func newOCSPResponderDesignatedCustomAddress(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string, addr string) *http.Server {
+	t.Helper()
+	return newOCSPResponderBase(t, issuerCertPEM, respCertPEM, respKeyPEM, true, addr, defaultResponseTTL)
+}
+
+func newOCSPResponderBase(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string, embed bool, addr string, responseTTL time.Duration) *http.Server {
 	t.Helper()
 	var mu sync.Mutex
 	status := make(map[string]int)
@@ -2943,7 +2964,9 @@ func newOCSPResponderDesignated(t *testing.T, issuerCertPEM, respCertPEM, respKe
 			Status:       n,
 			SerialNumber: ocspReq.SerialNumber,
 			ThisUpdate:   time.Now(),
-			NextUpdate:   time.Now().Add(4 * time.Second),
+		}
+		if responseTTL != 0 {
+			tmpl.NextUpdate = tmpl.ThisUpdate.Add(responseTTL)
 		}
 		if embed {
 			tmpl.Certificate = respCert
@@ -2961,7 +2984,7 @@ func newOCSPResponderDesignated(t *testing.T, issuerCertPEM, respCertPEM, respKe
 	})
 
 	srv := &http.Server{
-		Addr:    "127.0.0.1:8888",
+		Addr:    addr,
 		Handler: mux,
 	}
 	go srv.ListenAndServe()
@@ -3007,15 +3030,19 @@ func parseCertPEM(t *testing.T, certPEM string) *x509.Certificate {
 	return cert
 }
 
-func parseKeyPEM(t *testing.T, keyPEM string) *rsa.PrivateKey {
+func parseKeyPEM(t *testing.T, keyPEM string) crypto.Signer {
 	t.Helper()
 	block := parsePEM(t, keyPEM)
 
-	key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
 	if err != nil {
-		t.Fatalf("failed to parse ikey %s: %s", keyPEM, err)
+		key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
+		if err != nil {
+			t.Fatalf("failed to parse ikey %s: %s", keyPEM, err)
+		}
 	}
-	return key
+	keyc := key.(crypto.Signer)
+	return keyc
 }
 
 func parsePEM(t *testing.T, pemPath string) *pem.Block {

From 1f0b70d5fc821af0ef1af0ab276c25b84a5eaeda Mon Sep 17 00:00:00 2001
From: Todd Beets <todd@beetsme.net>
Date: Wed, 2 Aug 2023 11:52:36 -0700
Subject: [PATCH 07/14] Fixed local issuer determination for OCSP Staple, issue
 #3773

---
 server/certstore/certstore.go                 |  11 +
 server/client.go                              |   1 -
 server/monitor.go                             |   2 -
 server/ocsp.go                                | 104 +++++--
 .../misc/misconfig_TestServer1_bundle.pem     | 186 +++++++++++
 .../mini-ca/misc/trust_config1_bundle.pem     | 264 ++++++++++++++++
 .../mini-ca/misc/trust_config2_bundle.pem     | 264 ++++++++++++++++
 .../mini-ca/misc/trust_config3_bundle.pem     | 264 ++++++++++++++++
 test/ocsp_peer_test.go                        | 135 +++++---
 test/ocsp_test.go                             | 292 ++++++++++++++++--
 10 files changed, 1425 insertions(+), 98 deletions(-)
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/misc/misconfig_TestServer1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/misc/trust_config2_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/misc/trust_config3_bundle.pem

diff --git a/server/certstore/certstore.go b/server/certstore/certstore.go
index e6195b48..3d7dfde6 100644
--- a/server/certstore/certstore.go
+++ b/server/certstore/certstore.go
@@ -15,6 +15,7 @@ package certstore
 
 import (
 	"crypto"
+	"crypto/x509"
 	"io"
 	"runtime"
 	"strings"
@@ -82,6 +83,16 @@ func ParseCertMatchBy(certMatchBy string) (MatchByType, error) {
 	return certMatchByType, nil
 }
 
+func GetLeafIssuer(leaf *x509.Certificate, vOpts x509.VerifyOptions) (issuer *x509.Certificate) {
+	chains, err := leaf.Verify(vOpts)
+	if err != nil || len(chains) == 0 {
+		issuer = nil
+	} else {
+		issuer = chains[0][1]
+	}
+	return
+}
+
 // credential provides access to a public key and is a crypto.Signer.
 type credential interface {
 	// Public returns the public key corresponding to the leaf certificate.
diff --git a/server/client.go b/server/client.go
index a91058dc..b6f73442 100644
--- a/server/client.go
+++ b/server/client.go
@@ -204,7 +204,6 @@ const (
 	DuplicateServerName
 	MinimumVersionRequired
 	ClusterNamesIdentical
-	FailedOCSPPeerVerification
 )
 
 // Some flags passed to processMsgResults
diff --git a/server/monitor.go b/server/monitor.go
index 2c01c4e3..b7b26b48 100644
--- a/server/monitor.go
+++ b/server/monitor.go
@@ -2387,8 +2387,6 @@ func (reason ClosedState) String() string {
 		return "Minimum Version Required"
 	case ClusterNamesIdentical:
 		return "Cluster Names Identical"
-	case FailedOCSPPeerVerification:
-		return "Failed OCSP Peer Verification"
 	}
 
 	return "Unknown State"
diff --git a/server/ocsp.go b/server/ocsp.go
index 26a665b2..1c01132d 100644
--- a/server/ocsp.go
+++ b/server/ocsp.go
@@ -30,6 +30,8 @@ import (
 	"time"
 
 	"golang.org/x/crypto/ocsp"
+
+	"github.com/nats-io/nats-server/v2/server/certstore"
 )
 
 const (
@@ -389,7 +391,7 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
 		}
 
 		// TODO: Add OCSP 'responder_cert' option in case CA cert not available.
-		issuers, err := getOCSPIssuer(caFile, cert.Certificate)
+		issuer, err := getOCSPIssuer(caFile, cert.Certificate)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -402,7 +404,7 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
 			certFile:         certFile,
 			stopCh:           make(chan struct{}, 1),
 			Leaf:             cert.Leaf,
-			Issuer:           issuers[len(issuers)-1],
+			Issuer:           issuer,
 		}
 
 		// Get the certificate status from the memory, then remote OCSP responder.
@@ -449,7 +451,7 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
 
 				chain := s.VerifiedChains[0]
 				leaf := chain[0]
-				parent := issuers[len(issuers)-1]
+				parent := issuer
 
 				resp, err := ocsp.ParseResponseForCert(oresp, leaf, parent)
 				if err != nil {
@@ -833,37 +835,81 @@ func parseCertPEM(name string) ([]*x509.Certificate, error) {
 	return x509.ParseCertificates(pemBytes)
 }
 
-// getOCSPIssuer returns a CA cert from the given path. If the path is empty,
-// then this checks a given cert chain. If both are empty, then it returns an
-// error.
-func getOCSPIssuer(issuerCert string, chain [][]byte) ([]*x509.Certificate, error) {
-	var issuers []*x509.Certificate
-	var err error
-	switch {
-	case len(chain) == 1 && issuerCert == _EMPTY_:
-		err = fmt.Errorf("ocsp ca required in chain or configuration")
-	case issuerCert != _EMPTY_:
-		issuers, err = parseCertPEM(issuerCert)
-	case len(chain) > 1 && issuerCert == _EMPTY_:
-		issuers, err = x509.ParseCertificates(chain[1])
-	default:
-		err = fmt.Errorf("invalid ocsp ca configuration")
-	}
-	if err != nil {
-		return nil, err
+// getOCSPIssuerLocally determines a leaf's issuer from locally configured certificates
+func getOCSPIssuerLocally(trustedCAs []*x509.Certificate, certBundle []*x509.Certificate) (*x509.Certificate, error) {
+	var vOpts x509.VerifyOptions
+	var leaf *x509.Certificate
+	trustedCAPool := x509.NewCertPool()
+
+	// Require Leaf as first cert in bundle
+	if len(certBundle) > 0 {
+		leaf = certBundle[0]
+	} else {
+		return nil, fmt.Errorf("invalid ocsp ca configuration")
 	}
 
-	if len(issuers) == 0 {
-		return nil, fmt.Errorf("no issuers found")
-	}
-
-	for _, issuer := range issuers {
-		if !issuer.IsCA {
-			return nil, fmt.Errorf("%s invalid ca basic constraints: is not ca", issuer.Subject)
+	// Allow Issuer to be configured as second cert in bundle
+	if len(certBundle) > 1 {
+		// The operator may have misconfigured the cert bundle
+		issuerCandidate := certBundle[1]
+		err := issuerCandidate.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature)
+		if err != nil {
+			return nil, fmt.Errorf("invalid issuer configuration: %w", err)
+		} else {
+			return issuerCandidate, nil
 		}
 	}
 
-	return issuers, nil
+	// Operator did not provide the Leaf Issuer in cert bundle second position
+	// so we will attempt to create at least one ordered verified chain from the
+	// trusted CA pool.
+
+	// Specify CA trust store to validator; if unset, system trust store used
+	if len(trustedCAs) > 0 {
+		for _, ca := range trustedCAs {
+			trustedCAPool.AddCert(ca)
+		}
+		vOpts.Roots = trustedCAPool
+	}
+
+	return certstore.GetLeafIssuer(leaf, vOpts), nil
+}
+
+// getOCSPIssuer determines an issuer certificate from the cert (bundle) or the file-based CA trust store
+func getOCSPIssuer(caFile string, chain [][]byte) (*x509.Certificate, error) {
+	var issuer *x509.Certificate
+	var trustedCAs []*x509.Certificate
+	var certBundle []*x509.Certificate
+	var err error
+
+	// FIXME(tgb): extend if pluggable CA store provider added to NATS (i.e. other than PEM file)
+
+	// Non-system default CA trust store passed
+	if caFile != _EMPTY_ {
+		trustedCAs, err = parseCertPEM(caFile)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse ca_file: %v", err)
+		}
+	}
+
+	// Specify bundled intermediate CA store
+	for _, certBytes := range chain {
+		cert, err := x509.ParseCertificate(certBytes)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse cert: %v", err)
+		}
+		certBundle = append(certBundle, cert)
+	}
+
+	issuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)
+	if err != nil || issuer == nil {
+		return nil, fmt.Errorf("no issuers found")
+	}
+
+	if !issuer.IsCA {
+		return nil, fmt.Errorf("%s invalid ca basic constraints: is not ca", issuer.Subject)
+	}
+	return issuer, nil
 }
 
 func ocspStatusString(n int) string {
diff --git a/test/configs/certs/ocsp_peer/mini-ca/misc/misconfig_TestServer1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/misc/misconfig_TestServer1_bundle.pem
new file mode 100644
index 00000000..c3d1d2c9
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/misc/misconfig_TestServer1_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:c4:82:66:f8:5d:a6:b6:c7:66:e1:b2:01:3f:e0:72:fc:72:61:33
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Validity
+            Not Before: May  1 19:33:37 2023 GMT
+            Not After : Apr 28 19:33:37 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:af:26:5c:50:c0:fa:62:b5:fd:3d:c1:9e:26:51:
+                    58:62:04:37:b0:b5:6a:9b:6a:e3:22:3c:cd:ee:3c:
+                    e7:8b:d3:e2:4c:08:1a:4d:63:c1:81:20:f4:53:a5:
+                    5d:2f:d2:71:d8:af:e3:26:95:b4:27:14:46:7f:e2:
+                    0a:73:12:a7:0e:ff:99:5a:29:f5:d0:65:96:b1:d1:
+                    96:7f:0c:43:b8:71:f2:4b:21:e1:97:6c:1b:01:e5:
+                    38:1a:39:44:72:d5:19:20:87:fe:90:4f:3b:97:f2:
+                    7d:bd:57:97:4d:9d:56:50:89:5b:79:29:7a:3a:13:
+                    97:08:61:c2:0c:a6:02:49:c9:8a:41:ab:8e:9f:25:
+                    c9:33:18:f8:92:64:58:04:cc:a3:9d:cf:d4:d2:bd:
+                    20:ab:8b:9d:55:df:fb:5b:23:ac:95:12:fa:6f:07:
+                    93:3f:0e:03:86:c4:9b:25:06:21:9b:03:96:32:b8:
+                    e0:0f:63:e2:1d:34:d1:41:35:19:09:c1:a0:dc:26:
+                    b9:c8:66:fa:87:67:22:6e:0c:a6:e7:0f:24:64:b1:
+                    4f:84:05:ef:ad:8e:1b:f2:f4:38:87:d3:e3:48:a5:
+                    82:e0:66:89:1d:92:9a:59:67:a4:1d:03:6f:4d:a5:
+                    fb:3b:c0:0b:73:a7:ab:8f:b4:10:25:8e:69:42:76:
+                    82:5f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                43:16:E6:03:AF:37:B2:7B:BD:B3:C8:A2:9C:95:D7:FA:32:F8:9E:6F
+            X509v3 Authority Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:18888/intermediate1_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:18888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        a3:87:9f:05:e4:38:61:f7:c4:5b:17:13:4b:2c:9d:a2:4d:e6:
+        ad:93:54:c5:a3:00:27:0b:5c:45:c5:bd:f8:b6:a7:5a:2a:ec:
+        dc:9b:59:8a:c7:59:e7:b9:86:f7:27:be:45:0d:d9:86:76:cf:
+        00:71:ad:aa:cc:73:50:8c:68:63:b0:e2:3a:59:dd:85:fa:0d:
+        f0:82:51:05:79:e6:d5:0e:0b:bb:ed:23:65:8f:d0:8b:01:df:
+        86:74:bc:3a:22:90:e4:59:44:91:d5:44:d8:21:4d:4e:10:72:
+        0a:12:2e:4a:20:5f:15:e7:16:0b:6f:76:f3:04:1f:da:44:50:
+        3b:c3:b3:0f:fa:05:cf:6e:64:9c:65:e2:0d:38:28:31:c3:c3:
+        b6:66:ef:80:d3:c4:5f:e9:f9:01:e9:ce:e6:99:46:a0:9d:ce:
+        90:63:77:d2:85:21:d7:88:32:55:38:fe:10:07:69:cd:c8:06:
+        b7:6f:49:98:bf:cd:be:4f:ab:44:ea:78:af:ab:01:c8:3e:fa:
+        d9:54:bc:59:28:db:03:9b:1c:ee:e4:c3:ed:f3:97:30:c6:40:
+        33:76:84:40:b2:b8:4d:b4:ca:a9:2d:d1:4d:17:92:ea:c0:c9:
+        cb:f6:b1:d7:d3:c7:e6:75:15:00:ff:c7:d9:54:63:27:19:5c:
+        96:a5:e5:d9
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUPMSCZvhdprbHZuGyAT/gcvxyYTMwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMTAe
+Fw0yMzA1MDExOTMzMzdaFw0zMzA0MjgxOTMzMzdaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCvJlxQwPpitf09wZ4mUVhiBDewtWqbauMiPM3uPOeL0+JMCBpNY8GBIPRT
+pV0v0nHYr+MmlbQnFEZ/4gpzEqcO/5laKfXQZZax0ZZ/DEO4cfJLIeGXbBsB5Tga
+OURy1Rkgh/6QTzuX8n29V5dNnVZQiVt5KXo6E5cIYcIMpgJJyYpBq46fJckzGPiS
+ZFgEzKOdz9TSvSCri51V3/tbI6yVEvpvB5M/DgOGxJslBiGbA5YyuOAPY+IdNNFB
+NRkJwaDcJrnIZvqHZyJuDKbnDyRksU+EBe+tjhvy9DiH0+NIpYLgZokdkppZZ6Qd
+A29Npfs7wAtzp6uPtBAljmlCdoJfAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUQxbm
+A683snu9s8iinJXX+jL4nm8wHwYDVR0jBBgwFoAUtZFuT2S3FoR2+bS+mc5glZga
+jp0wDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjE4ODg4L2ludGVybWVkaWF0ZTFfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+MTg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAo4efBeQ4YffEWxcTSyydok3mrZNUxaMAJwtcRcW9+LanWirs3JtZisdZ
+57mG9ye+RQ3ZhnbPAHGtqsxzUIxoY7DiOlndhfoN8IJRBXnm1Q4Lu+0jZY/QiwHf
+hnS8OiKQ5FlEkdVE2CFNThByChIuSiBfFecWC2928wQf2kRQO8OzD/oFz25knGXi
+DTgoMcPDtmbvgNPEX+n5AenO5plGoJ3OkGN30oUh14gyVTj+EAdpzcgGt29JmL/N
+vk+rROp4r6sByD762VS8WSjbA5sc7uTD7fOXMMZAM3aEQLK4TbTKqS3RTReS6sDJ
+y/ax19PH5nUVAP/H2VRjJxlclqXl2Q==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem
new file mode 100644
index 00000000..f632ad54
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem
@@ -0,0 +1,264 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config2_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config2_bundle.pem
new file mode 100644
index 00000000..fb390ca1
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config2_bundle.pem
@@ -0,0 +1,264 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config3_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config3_bundle.pem
new file mode 100644
index 00000000..2ba91b0d
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/misc/trust_config3_bundle.pem
@@ -0,0 +1,264 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            55:57:db:45:43:06:ce:52:63:59:b9:5a:26:78:fd:0d:94:68:95:9c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:15 2023 GMT
+            Not After : Apr 28 19:01:15 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bc:c6:84:2d:c2:ab:5d:05:d7:65:a8:e2:15:74:
+                    d8:f2:f1:55:11:45:93:96:4c:a5:dc:cb:44:f5:f4:
+                    14:7e:46:02:59:e8:ae:78:59:69:21:58:f7:16:38:
+                    b9:c2:c2:60:d8:76:ab:a1:39:ba:0b:a3:03:17:e4:
+                    a1:cb:5d:1a:0c:62:71:24:64:b0:00:f0:6f:4c:af:
+                    08:62:8c:dc:4f:e0:d7:d4:55:2c:db:36:fc:a9:aa:
+                    d7:58:27:e4:99:cb:dc:29:d9:ea:35:16:cb:2e:be:
+                    04:b2:82:58:f4:e5:5c:07:db:12:8e:e3:3c:9a:5e:
+                    90:4b:c5:a3:d4:21:96:5f:e1:8f:f7:cb:9e:db:e0:
+                    10:a0:6c:a2:1e:30:17:6c:32:9f:7b:43:a4:9f:d3:
+                    6b:33:1b:18:cd:a4:ad:33:48:a3:98:b0:2b:c8:22:
+                    74:17:71:d8:f1:64:21:55:e1:33:bc:7f:74:5f:a5:
+                    a6:a2:9b:58:2f:db:ed:c7:c1:e5:36:2e:86:26:ad:
+                    c6:fe:b8:00:85:6e:7c:ed:fd:4a:c6:a0:d9:b2:3f:
+                    4e:bd:fa:08:52:c8:5d:31:13:86:bd:3f:ec:7a:d8:
+                    3a:15:e2:71:af:ec:00:88:7e:a6:e8:e1:9d:ab:57:
+                    5a:8a:1f:f8:e2:4d:29:58:53:79:25:f0:9e:d9:18:
+                    40:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B5:91:6E:4F:64:B7:16:84:76:F9:B4:BE:99:CE:60:95:98:1A:8E:9D
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b1:48:16:3b:d7:91:d0:4d:54:09:cb:ab:c7:41:4f:35:12:8b:
+        a6:e8:84:11:49:a9:04:91:41:25:7c:02:38:b2:19:a0:e9:2e:
+        d5:d6:7a:26:c1:1a:f8:f1:c6:51:92:68:af:c8:6e:5b:df:28:
+        40:b8:99:94:d5:43:7d:e3:68:75:94:26:56:11:21:9e:50:b3:
+        36:7b:f8:5f:33:76:64:71:04:26:2b:bb:2c:83:33:89:ba:74:
+        c1:e9:9d:eb:c0:86:4b:4d:6f:f8:4d:55:5a:3d:f6:55:95:33:
+        0f:b8:f0:53:2b:93:a6:da:8d:5c:1a:e8:30:22:55:67:44:6e:
+        17:c4:57:05:0d:ce:fc:61:dd:b1:3c:b0:66:55:f4:42:d0:ce:
+        94:7d:6a:82:bd:32:ed:2f:21:ff:c7:70:ff:48:9d:10:4a:71:
+        be:a8:37:e5:0f:f4:79:1e:7d:a2:f1:6a:6b:2c:e8:03:20:ce:
+        80:94:d2:38:80:bc:7e:56:c5:77:62:94:c0:b7:40:11:4d:ba:
+        98:4b:2e:52:03:66:68:36:ab:d1:0f:3e:b5:92:a3:95:9d:a4:
+        ea:d3:8a:14:41:6d:86:24:89:aa:d7:29:20:c8:52:d5:bf:8d:
+        3b:09:52:dd:89:8c:2c:85:40:b5:9f:cc:47:63:ca:3a:e0:c9:
+        91:5c:43:a9
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUVVfbRUMGzlJjWblaJnj9DZRolZwwDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDExNVoXDTMzMDQyODE5MDExNVowWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALzGhC3Cq10F12Wo4hV02PLxVRFFk5ZMpdzLRPX0FH5GAlnornhZaSFY9xY4ucLC
+YNh2q6E5ugujAxfkoctdGgxicSRksADwb0yvCGKM3E/g19RVLNs2/Kmq11gn5JnL
+3CnZ6jUWyy6+BLKCWPTlXAfbEo7jPJpekEvFo9Qhll/hj/fLntvgEKBsoh4wF2wy
+n3tDpJ/TazMbGM2krTNIo5iwK8gidBdx2PFkIVXhM7x/dF+lpqKbWC/b7cfB5TYu
+hiatxv64AIVufO39Ssag2bI/Tr36CFLIXTEThr0/7HrYOhXica/sAIh+pujhnatX
+Woof+OJNKVhTeSXwntkYQCcCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUtZFuT2S3FoR2
++bS+mc5glZgajp0wHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBALFIFjvXkdBNVAnLq8dBTzUSi6bohBFJqQSRQSV8AjiyGaDp
+LtXWeibBGvjxxlGSaK/IblvfKEC4mZTVQ33jaHWUJlYRIZ5QszZ7+F8zdmRxBCYr
+uyyDM4m6dMHpnevAhktNb/hNVVo99lWVMw+48FMrk6bajVwa6DAiVWdEbhfEVwUN
+zvxh3bE8sGZV9ELQzpR9aoK9Mu0vIf/HcP9InRBKcb6oN+UP9HkefaLxamss6AMg
+zoCU0jiAvH5WxXdilMC3QBFNuphLLlIDZmg2q9EPPrWSo5WdpOrTihRBbYYkiarX
+KSDIUtW/jTsJUt2JjCyFQLWfzEdjyjrgyZFcQ6k=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:5e:cf:7e:be:aa:02:b9:a9:c7:42:30:43:fe:0e:80:05:91:dd:0b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 18:57:57 2023 GMT
+            Not After : Apr 28 18:57:57 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e2:21:6b:9f:ef:48:b9:de:22:fb:5b:37:09:68:
+                    c7:b5:92:57:52:24:ef:85:00:e8:71:85:4d:0f:5b:
+                    8c:c6:e7:4f:19:f6:e3:0b:70:a3:41:7e:71:d4:0f:
+                    d6:fd:f2:1a:ca:aa:57:91:76:9a:b2:82:62:60:ce:
+                    f2:00:2e:d4:bc:58:d3:60:30:42:a6:28:b2:50:7b:
+                    58:01:9f:fb:0a:65:b0:40:d6:7c:e2:b7:da:8d:19:
+                    d9:a5:51:d2:46:7e:14:46:ab:fa:df:ce:fe:84:08:
+                    98:63:46:1d:4d:8a:77:57:67:da:16:8b:32:0c:7c:
+                    41:e2:a5:ec:ee:7d:20:28:eb:03:5f:f5:e6:05:d8:
+                    8b:96:78:6f:ae:29:9a:50:f7:dc:96:31:86:81:b1:
+                    78:e8:eb:ef:5d:bb:ed:42:ec:94:c6:54:46:ec:05:
+                    6f:1b:0c:36:24:c6:a8:06:7e:5c:56:b8:43:3b:11:
+                    f4:06:0a:05:15:19:3b:1f:c8:67:31:eb:3b:5b:2a:
+                    15:0a:7b:f9:6b:e4:10:ee:44:be:19:d8:db:44:01:
+                    fa:3a:56:f5:6c:4e:f3:60:aa:e4:cd:b2:ad:77:07:
+                    45:ef:f1:d7:f5:fa:52:84:5c:03:4e:72:e0:a9:91:
+                    c5:d9:d6:0a:84:33:98:31:f2:02:5b:3f:10:15:65:
+                    76:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:79:1a:b9:5d:fa:f5:c9:a3:88:22:c4:92:e6:64:6d:ce:a5:
+        ae:2e:69:48:6a:9e:d5:11:c5:bb:b0:de:38:1b:5b:04:85:60:
+        d6:64:14:ed:c2:62:02:7d:ad:d2:17:ad:ef:40:27:2b:50:59:
+        4a:ff:88:c6:b3:16:5c:55:30:d9:23:bd:4f:0f:34:b7:7b:ed:
+        7a:e1:f3:39:35:e9:18:6d:70:b1:2b:2a:e2:e5:cd:a1:54:8a:
+        f9:f4:95:81:29:84:3f:95:2f:48:e0:35:3e:d9:cb:84:4d:3d:
+        3e:3c:0e:8d:24:42:5f:19:e6:06:a5:87:ae:ba:af:07:02:e7:
+        6a:83:0a:89:d4:a4:38:ce:05:6e:f6:15:f1:7a:53:bb:50:28:
+        89:51:3f:f2:54:f1:d3:c4:28:07:a1:3e:55:e5:84:b8:df:58:
+        af:c3:e7:81:c2:08:9c:35:e4:c4:86:75:a8:17:99:2c:a6:7f:
+        46:30:9b:23:55:c5:d8:e2:6a:e4:08:a1:8b:dc:bc:5b:86:95:
+        4a:79:fe:a6:93:3d:1a:5b:10:9a:2f:6a:45:2f:5d:c9:fa:95:
+        2e:66:eb:52:df:88:a7:5f:42:8f:5f:46:07:79:8b:a7:49:82:
+        d3:81:c6:3e:c2:5a:15:c4:83:69:30:49:4d:6e:ea:05:1e:d8:
+        dc:29:ac:17
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArCgAwIBAgIUJ17Pfr6qArmpx0IwQ/4OgAWR3QswDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE4
+NTc1N1oXDTMzMDQyODE4NTc1N1owUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdS
+b290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iFrn+9Iud4i
++1s3CWjHtZJXUiTvhQDocYVND1uMxudPGfbjC3CjQX5x1A/W/fIayqpXkXaasoJi
+YM7yAC7UvFjTYDBCpiiyUHtYAZ/7CmWwQNZ84rfajRnZpVHSRn4URqv6387+hAiY
+Y0YdTYp3V2faFosyDHxB4qXs7n0gKOsDX/XmBdiLlnhvrimaUPfcljGGgbF46Ovv
+XbvtQuyUxlRG7AVvGww2JMaoBn5cVrhDOxH0BgoFFRk7H8hnMes7WyoVCnv5a+QQ
+7kS+GdjbRAH6Olb1bE7zYKrkzbKtdwdF7/HX9fpShFwDTnLgqZHF2dYKhDOYMfIC
+Wz8QFWV21wIDAQABo4GZMIGWMB0GA1UdDgQWBBTDEkK6qdhN4MM+utdHQaYJL220
+4TAfBgNVHSMEGDAWgBTDEkK6qdhN4MM+utdHQaYJL2204TAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBhjAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vMTI3
+LjAuMC4xOjg4ODgvcm9vdF9jcmwuZGVyMA0GCSqGSIb3DQEBCwUAA4IBAQAieRq5
+Xfr1yaOIIsSS5mRtzqWuLmlIap7VEcW7sN44G1sEhWDWZBTtwmICfa3SF63vQCcr
+UFlK/4jGsxZcVTDZI71PDzS3e+164fM5NekYbXCxKyri5c2hVIr59JWBKYQ/lS9I
+4DU+2cuETT0+PA6NJEJfGeYGpYeuuq8HAudqgwqJ1KQ4zgVu9hXxelO7UCiJUT/y
+VPHTxCgHoT5V5YS431ivw+eBwgicNeTEhnWoF5kspn9GMJsjVcXY4mrkCKGL3Lxb
+hpVKef6mkz0aWxCaL2pFL13J+pUuZutS34inX0KPX0YHeYunSYLTgcY+wloVxINp
+MElNbuoFHtjcKawX
+-----END CERTIFICATE-----
diff --git a/test/ocsp_peer_test.go b/test/ocsp_peer_test.go
index 8a2d1699..636c1876 100644
--- a/test/ocsp_peer_test.go
+++ b/test/ocsp_peer_test.go
@@ -15,6 +15,7 @@ package test
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -1736,19 +1737,12 @@ func TestOCSPStapleFeatureInterop(t *testing.T) {
 	rootCAResponderURL := fmt.Sprintf("http://%s", rootCAResponder.Addr)
 	defer rootCAResponder.Shutdown(ctx)
 	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate1/intermediate1_cert.pem", ocsp.Good)
-	setOCSPStatus(t, rootCAResponderURL, "configs/certs/ocsp_peer/mini-ca/intermediate2/intermediate2_cert.pem", ocsp.Good)
 
 	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
 	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
 	defer intermediateCA1Responder.Shutdown(ctx)
-	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
 	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Good)
 
-	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
-	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
-	defer intermediateCA2Responder.Shutdown(ctx)
-	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/client2/UserB1_cert.pem", ocsp.Good)
-
 	for _, test := range []struct {
 		name      string
 		config    string
@@ -1758,7 +1752,7 @@ func TestOCSPStapleFeatureInterop(t *testing.T) {
 		configure func()
 	}{
 		{
-			"Interop: mTLS OCSP peer check on inbound client connection, client of intermediate CA 1",
+			"Interop: Both Good: mTLS OCSP peer check on inbound client connection and server's OCSP staple validated at client",
 			`
 				port: -1
 				ocsp_cache: true
@@ -1766,8 +1760,7 @@ func TestOCSPStapleFeatureInterop(t *testing.T) {
 					mode: always
 				}
 				tls: {
-					# cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
-					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
 					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
 					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
 					timeout: 5
@@ -1781,47 +1774,105 @@ func TestOCSPStapleFeatureInterop(t *testing.T) {
 				}
 			`,
 			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return fmt.Errorf("expected OCSP staple to be present")
+						}
+						resp, err := ocsp.ParseResponse(s.OCSPResponse, s.VerifiedChains[0][1])
+						if err != nil || resp.Status != ocsp.Good {
+							return fmt.Errorf("expected a valid GOOD stapled response")
+						}
+						return nil
+					},
+				}),
 				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
 				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
 				nats.ErrorHandler(noOpErrHandler),
 			},
 			nil,
 			nil,
-			func() {},
+			func() {
+				setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Good)
+			},
+		},
+		{
+			"Interop: Bad Client: mTLS OCSP peer check on inbound client connection and server's OCSP staple validated at client",
+			`
+				port: -1
+				ocsp_cache: true
+				ocsp: {
+					mode: always
+				}
+				tls: {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+					verify: true
+					# Long form configuration, non-default ca_timeout
+					ocsp_peer: {
+						verify: true
+						ca_timeout: 5
+						allowed_clockskew: 30
+					}
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return fmt.Errorf("expected OCSP staple to be present")
+						}
+						resp, err := ocsp.ParseResponse(s.OCSPResponse, s.VerifiedChains[0][1])
+						if err != nil || resp.Status != ocsp.Good {
+							return fmt.Errorf("expected a valid GOOD stapled response")
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp_peer/mini-ca/client1/UserA1_bundle.pem", "./configs/certs/ocsp_peer/mini-ca/client1/private/UserA1_keypair.pem"),
+				nats.RootCAs("./configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			fmt.Errorf("remote error: tls: bad certificate"),
+			nil,
+			func() {
+				setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/client1/UserA1_cert.pem", ocsp.Revoked)
+			},
 		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			// TODO(tgb) - come back to this test after fixing OCSP Staple issue https://github.com/nats-io/nats-server/issues/3773
-			//deleteLocalStore(t, "")
-			//test.configure()
-			//content := test.config
-			//conf := createConfFile(t, []byte(content))
-			//
-			//s, opts := RunServerWithConfig(conf)
-			//defer s.Shutdown()
-			//nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
-			//if test.err == nil && err != nil {
-			//	t.Errorf("Expected to connect, got %v", err)
-			//} else if test.err != nil && err == nil {
-			//	t.Errorf("Expected error on connect")
-			//} else if test.err != nil && err != nil {
-			//	// Error on connect was expected
-			//	if test.err.Error() != err.Error() {
-			//		t.Errorf("Expected error %s, got: %s", test.err, err)
-			//	}
-			//	return
-			//}
-			//defer nc.Close()
-			//nc.Subscribe("ping", func(m *nats.Msg) {
-			//	m.Respond([]byte("pong"))
-			//})
-			//nc.Flush()
-			//_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
-			//if test.rerr != nil && err == nil {
-			//	t.Errorf("Expected error getting response")
-			//} else if test.rerr == nil && err != nil {
-			//	t.Errorf("Expected response")
-			//}
+			deleteLocalStore(t, "")
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+
+			s, opts := RunServerWithConfig(conf)
+			defer s.Shutdown()
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+			nc.Subscribe("ping", func(m *nats.Msg) {
+				m.Respond([]byte("pong"))
+			})
+			nc.Flush()
+			_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			if test.rerr != nil && err == nil {
+				t.Errorf("Expected error getting response")
+			} else if test.rerr == nil && err != nil {
+				t.Errorf("Expected response")
+			}
 		})
 	}
 }
diff --git a/test/ocsp_test.go b/test/ocsp_test.go
index 3ff0cd16..be9d0bab 100644
--- a/test/ocsp_test.go
+++ b/test/ocsp_test.go
@@ -2296,20 +2296,14 @@ func TestOCSPGateway(t *testing.T) {
 }
 
 func TestOCSPGatewayIntermediate(t *testing.T) {
-	const (
-		caCert       = "configs/certs/ocsp/desgsign/ca-cert.pem"
-		caIntermCert = "configs/certs/ocsp/desgsign/ca-interm-cert.pem"
-		caIntermKey  = "configs/certs/ocsp/desgsign/ca-interm-key.pem"
-	)
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	ocspr := newOCSPResponderDesignated(t, caCert, caIntermCert, caIntermKey)
-	defer ocspr.Shutdown(ctx)
-
-	addr := fmt.Sprintf("http://%s", ocspr.Addr)
-	setOCSPStatus(t, addr, "configs/certs/ocsp/desgsign/server-01-cert.pem", ocsp.Good)
-	setOCSPStatus(t, addr, "configs/certs/ocsp/desgsign/server-02-cert.pem", ocsp.Good)
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Good)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_cert.pem", ocsp.Good)
 
 	// Gateway server configuration
 	srvConfA := `
@@ -2330,14 +2324,14 @@ func TestOCSPGatewayIntermediate(t *testing.T) {
 			advertise: "127.0.0.1"
 
 			tls {
-				cert_file: "configs/certs/ocsp/desgsign/server-01-cert.pem"
-				key_file: "configs/certs/ocsp/desgsign/server-01-key.pem"
-				ca_file: "configs/certs/ocsp/desgsign/ca-chain-cert.pem"
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
 				timeout: 5
 			}
 		}
 	`
-	srvConfA = fmt.Sprintf(srvConfA, addr)
+	srvConfA = fmt.Sprintf(srvConfA, intermediateCA1ResponderURL)
 	sconfA := createConfFile(t, []byte(srvConfA))
 	srvA, optsA := RunServerWithConfig(sconfA)
 	defer srvA.Shutdown()
@@ -2363,14 +2357,14 @@ func TestOCSPGatewayIntermediate(t *testing.T) {
 				url: "nats://127.0.0.1:%d"
 			}]
 			tls {
-				cert_file: "configs/certs/ocsp/desgsign/server-02-cert.pem"
-				key_file: "configs/certs/ocsp/desgsign/server-02-key.pem"
-				ca_file: "configs/certs/ocsp/desgsign/ca-chain-cert.pem"
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer2_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer2_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
 				timeout: 5
 			}
 		}
 	`
-	srvConfB = fmt.Sprintf(srvConfB, addr, optsA.Gateway.Port)
+	srvConfB = fmt.Sprintf(srvConfB, intermediateCA1ResponderURL, optsA.Gateway.Port)
 	conf := createConfFile(t, []byte(srvConfB))
 	srvB, optsB := RunServerWithConfig(conf)
 	defer srvB.Shutdown()
@@ -2873,11 +2867,6 @@ func newOCSPResponder(t *testing.T, issuerCertPEM, issuerKeyPEM string) *http.Se
 	return newOCSPResponderBase(t, issuerCertPEM, issuerCertPEM, issuerKeyPEM, false, defaultAddress, defaultResponseTTL)
 }
 
-func newOCSPResponderDesignated(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string) *http.Server {
-	t.Helper()
-	return newOCSPResponderBase(t, issuerCertPEM, respCertPEM, respKeyPEM, true, defaultAddress, defaultResponseTTL)
-}
-
 func newOCSPResponderDesignatedCustomAddress(t *testing.T, issuerCertPEM, respCertPEM, respKeyPEM string, addr string) *http.Server {
 	t.Helper()
 	return newOCSPResponderBase(t, issuerCertPEM, respCertPEM, respKeyPEM, true, addr, defaultResponseTTL)
@@ -3441,3 +3430,258 @@ func TestOCSPSuperCluster(t *testing.T) {
 		t.Errorf("Expected single gateway, got: %v", n)
 	}
 }
+
+func TestOCSPLocalIssuerDetermination(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+
+	// Test constants
+	ocspURL := intermediateCA1ResponderURL
+	clientTrustBundle := "configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem"
+	serverCert := "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+
+	var (
+		errMissingStaple = fmt.Errorf("missing OCSP Staple from server")
+	)
+
+	for _, test := range []struct {
+		name        string
+		config      string
+		opts        []nats.Option
+		err         error
+		rerr        error
+		serverStart bool
+		configure   func()
+	}{
+		{
+			"Correct issuer configured in cert bundle",
+			`
+				port: -1
+
+				ocsp {
+					mode: always
+				}
+
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return errMissingStaple
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp/client-cert.pem", "./configs/certs/ocsp/client-key.pem"),
+				nats.RootCAs(clientTrustBundle),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			true,
+			func() {
+				setOCSPStatus(t, ocspURL, serverCert, ocsp.Good)
+			},
+		},
+		{
+			"Wrong issuer configured in cert bundle, server no start",
+			`
+				port: -1
+
+				ocsp {
+					mode: always
+				}
+
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/misc/misconfig_TestServer1_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return errMissingStaple
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp/client-cert.pem", "./configs/certs/ocsp/client-key.pem"),
+				nats.RootCAs(clientTrustBundle),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			false,
+			func() {
+				setOCSPStatus(t, ocspURL, serverCert, ocsp.Good)
+			},
+		},
+		{
+			"Issuer configured in CA bundle only, configuration 1",
+			`
+				port: -1
+
+				ocsp {
+					mode: always
+				}
+
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/misc/trust_config1_bundle.pem"
+					timeout: 5
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return errMissingStaple
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp/client-cert.pem", "./configs/certs/ocsp/client-key.pem"),
+				nats.RootCAs(clientTrustBundle),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			true,
+			func() {
+				setOCSPStatus(t, ocspURL, serverCert, ocsp.Good)
+			},
+		},
+		{
+			"Issuer configured in CA bundle only, configuration 2",
+			`
+				port: -1
+
+				ocsp {
+					mode: always
+				}
+
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/misc/trust_config2_bundle.pem"
+					timeout: 5
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return errMissingStaple
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp/client-cert.pem", "./configs/certs/ocsp/client-key.pem"),
+				nats.RootCAs(clientTrustBundle),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			true,
+			func() {
+				setOCSPStatus(t, ocspURL, serverCert, ocsp.Good)
+			},
+		},
+		{
+			"Issuer configured in CA bundle only, configuration 3",
+			`
+				port: -1
+
+				ocsp {
+					mode: always
+				}
+
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/misc/trust_config3_bundle.pem"
+					timeout: 5
+				}
+			`,
+			[]nats.Option{
+				nats.Secure(&tls.Config{
+					VerifyConnection: func(s tls.ConnectionState) error {
+						if s.OCSPResponse == nil {
+							return errMissingStaple
+						}
+						return nil
+					},
+				}),
+				nats.ClientCert("./configs/certs/ocsp/client-cert.pem", "./configs/certs/ocsp/client-key.pem"),
+				nats.RootCAs(clientTrustBundle),
+				nats.ErrorHandler(noOpErrHandler),
+			},
+			nil,
+			nil,
+			true,
+			func() {
+				setOCSPStatus(t, ocspURL, serverCert, ocsp.Good)
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			defer func() {
+				r := recover()
+				if r != nil && test.serverStart {
+					t.Fatalf("Expected server start, unexpected panic: %v", r)
+				}
+				if r == nil && !test.serverStart {
+					t.Fatalf("Expected server to not start and panic thrown")
+				}
+			}()
+			test.configure()
+			content := test.config
+			conf := createConfFile(t, []byte(content))
+			s, opts := RunServerWithConfig(conf)
+			// server may not start for some tests
+			if s != nil {
+				defer s.Shutdown()
+			}
+
+			nc, err := nats.Connect(fmt.Sprintf("tls://localhost:%d", opts.Port), test.opts...)
+			if test.err == nil && err != nil {
+				t.Errorf("Expected to connect, got %v", err)
+			} else if test.err != nil && err == nil {
+				t.Errorf("Expected error on connect")
+			} else if test.err != nil && err != nil {
+				// Error on connect was expected
+				if test.err.Error() != err.Error() {
+					t.Errorf("Expected error %s, got: %s", test.err, err)
+				}
+				return
+			}
+			defer nc.Close()
+
+			nc.Subscribe("ping", func(m *nats.Msg) {
+				m.Respond([]byte("pong"))
+			})
+			nc.Flush()
+
+			_, err = nc.Request("ping", []byte("ping"), 250*time.Millisecond)
+			if test.rerr != nil && err == nil {
+				t.Errorf("Expected error getting response")
+			} else if test.rerr == nil && err != nil {
+				t.Errorf("Expected response")
+			}
+		})
+	}
+}

From ac43a8d4eb76d6cd27f26c958b80f7c8a22ec6e4 Mon Sep 17 00:00:00 2001
From: Todd Beets <todd@beetsme.net>
Date: Wed, 2 Aug 2023 16:09:21 -0700
Subject: [PATCH 08/14] Enhance OCSP peer validation for GATEWAY and ROUTE
 connections. Nodes no longer required to have same CA issuer. OCSP response
 effectivity now checked using default clock skew and default validity period
 if not asserted by responder.

---
 server/ocsp.go                                |  30 +-
 .../mini-ca/server2/TestServer3_bundle.pem    | 186 ++++++++++++
 .../mini-ca/server2/TestServer3_cert.pem      |  97 ++++++
 .../mini-ca/server2/TestServer4_bundle.pem    | 186 ++++++++++++
 .../mini-ca/server2/TestServer4_cert.pem      |  97 ++++++
 .../server2/private/TestServer3_keypair.pem   |  28 ++
 .../server2/private/TestServer4_keypair.pem   |  28 ++
 test/ocsp_test.go                             | 281 ++++++++++++++++++
 8 files changed, 922 insertions(+), 11 deletions(-)
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_bundle.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_cert.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem
 create mode 100644 test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer4_keypair.pem

diff --git a/server/ocsp.go b/server/ocsp.go
index 1c01132d..cd950ae3 100644
--- a/server/ocsp.go
+++ b/server/ocsp.go
@@ -31,6 +31,7 @@ import (
 
 	"golang.org/x/crypto/ocsp"
 
+	"github.com/nats-io/nats-server/v2/server/certidp"
 	"github.com/nats-io/nats-server/v2/server/certstore"
 )
 
@@ -450,21 +451,20 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
 				}
 
 				chain := s.VerifiedChains[0]
-				leaf := chain[0]
-				parent := issuer
+				peerLeaf := chain[0]
+				peerIssuer := certidp.GetLeafIssuerCert(chain, 0)
+				if peerIssuer == nil {
+					return fmt.Errorf("failed to get issuer certificate for %s peer", kind)
+				}
 
-				resp, err := ocsp.ParseResponseForCert(oresp, leaf, parent)
+				// Response signature of issuer or issuer delegate is checked in the library parse
+				resp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)
 				if err != nil {
 					return fmt.Errorf("failed to parse OCSP response from %s peer: %w", kind, err)
 				}
-				if resp.Certificate == nil {
-					if err := resp.CheckSignatureFrom(parent); err != nil {
-						return fmt.Errorf("OCSP staple not issued by issuer: %w", err)
-					}
-				} else {
-					if err := resp.Certificate.CheckSignatureFrom(parent); err != nil {
-						return fmt.Errorf("OCSP staple's signer not signed by issuer: %w", err)
-					}
+
+				// If signer was issuer delegate double-check issuer delegate authorization
+				if resp.Certificate != nil {
 					ok := false
 					for _, eku := range resp.Certificate.ExtKeyUsage {
 						if eku == x509.ExtKeyUsageOCSPSigning {
@@ -476,6 +476,14 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
 						return fmt.Errorf("OCSP staple's signer missing authorization by CA to act as OCSP signer")
 					}
 				}
+
+				// Check that the OCSP response is effective, take defaults for clockskew and default validity
+				peerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}
+				sLog := certidp.Log{Debugf: srv.Debugf}
+				if !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {
+					return fmt.Errorf("OCSP staple from %s peer not current", kind)
+				}
+
 				if resp.Status != ocsp.Good {
 					return fmt.Errorf("bad status for OCSP Staple from %s peer: %s", kind, ocspStatusString(resp.Status))
 				}
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem
new file mode 100644
index 00000000..7a1ee483
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3e:1f:9b:cd:c8:7b:95:f1:64:e6:41:9c:df:6e:03:da:92:9a:90:b7
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: Aug  2 22:15:27 2023 GMT
+            Not After : Jul 30 22:15:27 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9a:3c:db:76:c9:19:0f:7b:e6:d3:ed:d1:0b:76:
+                    ae:15:d4:11:1c:66:b8:5d:2a:7d:e3:1f:65:d8:1b:
+                    c4:63:62:f6:5c:8b:18:66:a8:1c:c2:a6:5e:72:f2:
+                    dd:57:42:8a:ab:5d:bd:37:b6:f1:4b:51:f0:b3:6a:
+                    37:e9:55:78:01:23:ea:53:09:83:2f:7d:59:36:ab:
+                    33:4f:4c:bc:ef:a9:1c:db:94:79:4c:0d:4a:7c:3f:
+                    9d:3c:ba:6c:76:82:47:25:eb:79:22:f4:09:6c:78:
+                    3c:a6:ef:4b:30:90:29:b3:5f:ba:69:b1:1a:95:ed:
+                    53:e0:c6:24:78:6e:52:af:8e:bc:db:4a:f0:19:d2:
+                    00:5a:a8:b6:73:4c:17:92:d1:8d:81:9b:4c:b8:35:
+                    4d:91:dd:df:d3:85:a6:9f:c4:91:19:ec:47:d1:ca:
+                    4e:0b:c3:06:8c:27:42:95:83:e3:28:6a:3b:74:9c:
+                    68:b0:55:a5:91:91:cb:37:ad:fa:d8:69:8b:de:2e:
+                    4a:51:59:32:4b:3d:06:21:04:65:d2:f5:8b:e8:4d:
+                    45:96:de:63:97:47:81:85:ea:48:f0:9d:23:2d:71:
+                    87:6f:d2:75:3d:45:bf:de:ad:43:82:db:a5:29:9b:
+                    f9:5e:38:0a:39:a9:38:71:ec:40:40:b5:dc:69:c7:
+                    0b:73
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7F:47:8C:9E:F1:73:7E:34:B9:5B:1E:ED:AD:3A:87:42:80:D4:E3:FD
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b9:b4:05:48:a6:ba:6c:99:8b:23:c4:9b:b3:8a:32:3f:ca:62:
+        89:81:1e:5d:04:ba:2d:22:a3:0f:5a:5d:a0:ab:40:a4:87:43:
+        26:36:0a:09:64:ef:f5:b0:a7:6f:7a:1f:cc:06:6c:f7:8d:9c:
+        64:5e:c2:ae:e7:45:39:dc:bc:87:06:e6:d5:aa:6b:32:76:51:
+        64:e1:ac:d9:9a:dd:17:47:9b:4e:31:1c:93:f5:c5:ca:d6:b7:
+        90:ff:64:97:59:df:2b:7f:ee:2d:7d:73:ef:95:ad:b5:1e:a9:
+        0c:48:38:29:0b:39:4f:05:fb:07:cf:ec:94:a3:b3:d5:eb:00:
+        ed:b2:b9:71:a0:59:b5:3f:7c:f5:20:90:54:a8:ea:36:4c:ae:
+        62:5b:2b:6d:05:8d:76:78:87:c9:90:f3:b2:d1:72:fc:87:f5:
+        28:4c:ec:19:50:0f:02:32:d4:57:75:d9:c1:b2:dc:0e:d4:9a:
+        3a:cd:48:70:1e:c4:2e:fd:4f:b0:89:6a:de:f0:90:91:23:16:
+        cd:04:fc:61:87:9c:c3:5c:7e:0f:19:ff:26:3e:fb:1b:65:2a:
+        49:ae:47:9f:d5:e6:c8:30:bb:13:b9:48:d0:67:57:0f:fb:c6:
+        df:1c:fc:82:3b:ae:1f:f7:25:c8:df:c0:c5:d1:8d:51:94:74:
+        30:be:fb:f7
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUPh+bzch7lfFk5kGc324D2pKakLcwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA4MDIyMjE1MjdaFw0zMzA3MzAyMjE1MjdaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCaPNt2yRkPe+bT7dELdq4V1BEcZrhdKn3jH2XYG8RjYvZcixhmqBzCpl5y
+8t1XQoqrXb03tvFLUfCzajfpVXgBI+pTCYMvfVk2qzNPTLzvqRzblHlMDUp8P508
+umx2gkcl63ki9AlseDym70swkCmzX7ppsRqV7VPgxiR4blKvjrzbSvAZ0gBaqLZz
+TBeS0Y2Bm0y4NU2R3d/ThaafxJEZ7EfRyk4LwwaMJ0KVg+Moajt0nGiwVaWRkcs3
+rfrYaYveLkpRWTJLPQYhBGXS9YvoTUWW3mOXR4GF6kjwnSMtcYdv0nU9Rb/erUOC
+26Upm/leOAo5qThx7EBAtdxpxwtzAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUf0eM
+nvFzfjS5Wx7trTqHQoDU4/0wHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyiV3ft
+FawwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjI4ODg4L2ludGVybWVkaWF0ZTJfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+Mjg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAubQFSKa6bJmLI8Sbs4oyP8piiYEeXQS6LSKjD1pdoKtApIdDJjYKCWTv
+9bCnb3ofzAZs942cZF7CrudFOdy8hwbm1aprMnZRZOGs2ZrdF0ebTjEck/XFyta3
+kP9kl1nfK3/uLX1z75WttR6pDEg4KQs5TwX7B8/slKOz1esA7bK5caBZtT989SCQ
+VKjqNkyuYlsrbQWNdniHyZDzstFy/If1KEzsGVAPAjLUV3XZwbLcDtSaOs1IcB7E
+Lv1PsIlq3vCQkSMWzQT8YYecw1x+Dxn/Jj77G2UqSa5Hn9XmyDC7E7lI0GdXD/vG
+3xz8gjuuH/clyN/AxdGNUZR0ML779w==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_cert.pem
new file mode 100644
index 00000000..b061b3d4
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer3_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3e:1f:9b:cd:c8:7b:95:f1:64:e6:41:9c:df:6e:03:da:92:9a:90:b7
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: Aug  2 22:15:27 2023 GMT
+            Not After : Jul 30 22:15:27 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9a:3c:db:76:c9:19:0f:7b:e6:d3:ed:d1:0b:76:
+                    ae:15:d4:11:1c:66:b8:5d:2a:7d:e3:1f:65:d8:1b:
+                    c4:63:62:f6:5c:8b:18:66:a8:1c:c2:a6:5e:72:f2:
+                    dd:57:42:8a:ab:5d:bd:37:b6:f1:4b:51:f0:b3:6a:
+                    37:e9:55:78:01:23:ea:53:09:83:2f:7d:59:36:ab:
+                    33:4f:4c:bc:ef:a9:1c:db:94:79:4c:0d:4a:7c:3f:
+                    9d:3c:ba:6c:76:82:47:25:eb:79:22:f4:09:6c:78:
+                    3c:a6:ef:4b:30:90:29:b3:5f:ba:69:b1:1a:95:ed:
+                    53:e0:c6:24:78:6e:52:af:8e:bc:db:4a:f0:19:d2:
+                    00:5a:a8:b6:73:4c:17:92:d1:8d:81:9b:4c:b8:35:
+                    4d:91:dd:df:d3:85:a6:9f:c4:91:19:ec:47:d1:ca:
+                    4e:0b:c3:06:8c:27:42:95:83:e3:28:6a:3b:74:9c:
+                    68:b0:55:a5:91:91:cb:37:ad:fa:d8:69:8b:de:2e:
+                    4a:51:59:32:4b:3d:06:21:04:65:d2:f5:8b:e8:4d:
+                    45:96:de:63:97:47:81:85:ea:48:f0:9d:23:2d:71:
+                    87:6f:d2:75:3d:45:bf:de:ad:43:82:db:a5:29:9b:
+                    f9:5e:38:0a:39:a9:38:71:ec:40:40:b5:dc:69:c7:
+                    0b:73
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7F:47:8C:9E:F1:73:7E:34:B9:5B:1E:ED:AD:3A:87:42:80:D4:E3:FD
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b9:b4:05:48:a6:ba:6c:99:8b:23:c4:9b:b3:8a:32:3f:ca:62:
+        89:81:1e:5d:04:ba:2d:22:a3:0f:5a:5d:a0:ab:40:a4:87:43:
+        26:36:0a:09:64:ef:f5:b0:a7:6f:7a:1f:cc:06:6c:f7:8d:9c:
+        64:5e:c2:ae:e7:45:39:dc:bc:87:06:e6:d5:aa:6b:32:76:51:
+        64:e1:ac:d9:9a:dd:17:47:9b:4e:31:1c:93:f5:c5:ca:d6:b7:
+        90:ff:64:97:59:df:2b:7f:ee:2d:7d:73:ef:95:ad:b5:1e:a9:
+        0c:48:38:29:0b:39:4f:05:fb:07:cf:ec:94:a3:b3:d5:eb:00:
+        ed:b2:b9:71:a0:59:b5:3f:7c:f5:20:90:54:a8:ea:36:4c:ae:
+        62:5b:2b:6d:05:8d:76:78:87:c9:90:f3:b2:d1:72:fc:87:f5:
+        28:4c:ec:19:50:0f:02:32:d4:57:75:d9:c1:b2:dc:0e:d4:9a:
+        3a:cd:48:70:1e:c4:2e:fd:4f:b0:89:6a:de:f0:90:91:23:16:
+        cd:04:fc:61:87:9c:c3:5c:7e:0f:19:ff:26:3e:fb:1b:65:2a:
+        49:ae:47:9f:d5:e6:c8:30:bb:13:b9:48:d0:67:57:0f:fb:c6:
+        df:1c:fc:82:3b:ae:1f:f7:25:c8:df:c0:c5:d1:8d:51:94:74:
+        30:be:fb:f7
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUPh+bzch7lfFk5kGc324D2pKakLcwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA4MDIyMjE1MjdaFw0zMzA3MzAyMjE1MjdaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCaPNt2yRkPe+bT7dELdq4V1BEcZrhdKn3jH2XYG8RjYvZcixhmqBzCpl5y
+8t1XQoqrXb03tvFLUfCzajfpVXgBI+pTCYMvfVk2qzNPTLzvqRzblHlMDUp8P508
+umx2gkcl63ki9AlseDym70swkCmzX7ppsRqV7VPgxiR4blKvjrzbSvAZ0gBaqLZz
+TBeS0Y2Bm0y4NU2R3d/ThaafxJEZ7EfRyk4LwwaMJ0KVg+Moajt0nGiwVaWRkcs3
+rfrYaYveLkpRWTJLPQYhBGXS9YvoTUWW3mOXR4GF6kjwnSMtcYdv0nU9Rb/erUOC
+26Upm/leOAo5qThx7EBAtdxpxwtzAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUf0eM
+nvFzfjS5Wx7trTqHQoDU4/0wHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyiV3ft
+FawwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjI4ODg4L2ludGVybWVkaWF0ZTJfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+Mjg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAubQFSKa6bJmLI8Sbs4oyP8piiYEeXQS6LSKjD1pdoKtApIdDJjYKCWTv
+9bCnb3ofzAZs942cZF7CrudFOdy8hwbm1aprMnZRZOGs2ZrdF0ebTjEck/XFyta3
+kP9kl1nfK3/uLX1z75WttR6pDEg4KQs5TwX7B8/slKOz1esA7bK5caBZtT989SCQ
+VKjqNkyuYlsrbQWNdniHyZDzstFy/If1KEzsGVAPAjLUV3XZwbLcDtSaOs1IcB7E
+Lv1PsIlq3vCQkSMWzQT8YYecw1x+Dxn/Jj77G2UqSa5Hn9XmyDC7E7lI0GdXD/vG
+3xz8gjuuH/clyN/AxdGNUZR0ML779w==
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_bundle.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_bundle.pem
new file mode 100644
index 00000000..27f4217d
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_bundle.pem
@@ -0,0 +1,186 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            16:5e:ab:1c:8b:dc:fc:97:d9:34:9d:fd:cd:7d:b3:3c:51:83:ce:d2
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: Aug  2 22:15:38 2023 GMT
+            Not After : Jul 30 22:15:38 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:fd:fb:3f:42:c7:ca:02:37:72:6e:78:d5:af:
+                    8d:b4:4d:f4:4c:0c:8f:8f:67:da:62:c0:2a:0f:f3:
+                    73:3b:83:c1:3a:df:9e:df:1d:26:12:95:41:ca:52:
+                    88:4d:8b:38:7f:78:ce:ed:aa:48:b0:dc:57:62:80:
+                    7a:fc:1f:43:c8:d8:2d:4f:38:c3:22:fc:bb:16:53:
+                    84:9e:44:0c:f9:51:00:a0:57:97:3f:df:57:08:48:
+                    3b:2b:55:b3:90:98:98:e6:a6:eb:ca:8f:ec:f8:4f:
+                    dc:4d:7e:71:2e:03:ff:cd:fa:ef:65:7e:6d:8c:35:
+                    be:df:fb:c1:0b:e9:f0:3b:89:24:4d:b4:02:7f:82:
+                    8e:0a:34:ea:a8:68:9e:f8:4b:39:9a:8f:d5:eb:bc:
+                    59:68:c9:f0:a5:eb:e9:be:7c:03:49:bd:b5:d9:54:
+                    cf:88:29:b0:2c:a3:e9:08:b6:66:37:57:ef:66:5f:
+                    6b:0f:34:6d:02:bf:92:2b:cc:e9:9d:c0:a8:92:0d:
+                    76:8f:ae:f6:3f:24:38:e9:5b:fc:12:a2:ab:fa:42:
+                    3f:5a:05:e3:5e:bb:08:43:5d:55:18:17:13:0a:27:
+                    84:5f:05:69:18:a9:45:68:37:a7:35:f9:8c:ef:c5:
+                    9f:b1:8d:aa:3c:b7:cc:47:b6:e5:85:e2:73:f5:8a:
+                    5a:71
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C4:BB:A1:42:EA:15:3E:0E:D1:48:5F:B5:E2:01:42:D0:72:BE:B0:CE
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        85:c2:1a:b0:94:8b:a0:f8:2c:85:1e:17:88:4e:ca:2c:d1:f6:
+        69:26:e3:a6:94:9f:62:eb:68:54:da:2b:f2:67:23:be:4b:95:
+        56:28:08:7a:52:8e:b3:b2:70:2f:c9:db:06:74:b4:8b:8e:84:
+        23:0a:74:f7:c1:67:81:69:11:36:2b:0e:4c:0f:2c:76:e6:2d:
+        50:f3:e8:59:0d:3a:6c:30:eb:31:16:74:c8:34:d1:62:97:6b:
+        1e:2f:5c:56:b0:6e:bc:5e:08:8f:d4:ce:4a:d3:8e:91:70:7d:
+        18:d4:3f:40:39:39:67:95:68:f7:16:c6:19:69:41:c2:20:2e:
+        45:e3:9d:31:c2:da:67:8d:2c:1f:a2:3f:1e:46:23:19:fd:25:
+        16:69:5c:80:09:1b:f7:7f:50:47:1d:d9:6b:aa:7b:0f:20:8d:
+        5a:f4:37:f0:c3:a7:31:5f:4d:41:70:c8:c4:aa:2a:69:d0:a8:
+        7b:3c:cc:b4:a4:12:54:a3:bf:ce:ea:22:20:58:ae:eb:29:f3:
+        15:da:22:05:46:cd:26:ef:63:84:4a:5b:86:47:fe:cb:fa:4a:
+        0c:fe:82:e0:db:81:dc:3e:87:8f:93:23:32:de:37:3d:d7:0f:
+        6c:f1:74:63:8b:11:b7:f3:69:b7:d6:e0:72:b2:1d:e1:15:10:
+        7d:2e:97:de
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUFl6rHIvc/JfZNJ39zX2zPFGDztIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA4MDIyMjE1MzhaFw0zMzA3MzAyMjE1MzhaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDV/fs/QsfKAjdybnjVr420TfRMDI+PZ9piwCoP83M7g8E6357fHSYSlUHK
+UohNizh/eM7tqkiw3FdigHr8H0PI2C1POMMi/LsWU4SeRAz5UQCgV5c/31cISDsr
+VbOQmJjmpuvKj+z4T9xNfnEuA//N+u9lfm2MNb7f+8EL6fA7iSRNtAJ/go4KNOqo
+aJ74Szmaj9XrvFloyfCl6+m+fANJvbXZVM+IKbAso+kItmY3V+9mX2sPNG0Cv5Ir
+zOmdwKiSDXaPrvY/JDjpW/wSoqv6Qj9aBeNeuwhDXVUYFxMKJ4RfBWkYqUVoN6c1
++YzvxZ+xjao8t8xHtuWF4nP1ilpxAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUxLuh
+QuoVPg7RSF+14gFC0HK+sM4wHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyiV3ft
+FawwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjI4ODg4L2ludGVybWVkaWF0ZTJfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+Mjg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAhcIasJSLoPgshR4XiE7KLNH2aSbjppSfYutoVNor8mcjvkuVVigIelKO
+s7JwL8nbBnS0i46EIwp098FngWkRNisOTA8sduYtUPPoWQ06bDDrMRZ0yDTRYpdr
+Hi9cVrBuvF4Ij9TOStOOkXB9GNQ/QDk5Z5Vo9xbGGWlBwiAuReOdMcLaZ40sH6I/
+HkYjGf0lFmlcgAkb939QRx3Za6p7DyCNWvQ38MOnMV9NQXDIxKoqadCoezzMtKQS
+VKO/zuoiIFiu6ynzFdoiBUbNJu9jhEpbhkf+y/pKDP6C4NuB3D6Hj5MjMt43PdcP
+bPF0Y4sRt/Npt9bgcrId4RUQfS6X3g==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3c:d7:16:fb:15:99:81:4e:53:f8:80:7c:b6:7c:77:a6:06:a4:3e:ea
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Root CA
+        Validity
+            Not Before: May  1 19:01:43 2023 GMT
+            Not After : Apr 28 19:01:43 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:5f:ff:1d:f7:8d:1a:9e:9a:f3:2b:68:8f:c1:
+                    0c:33:06:41:00:c9:3e:e4:1a:e1:e0:70:6a:f5:2f:
+                    ad:df:f3:e9:99:ed:c5:d7:aa:93:13:37:ff:47:aa:
+                    f3:c5:89:f7:b7:ad:3a:47:e5:9c:4e:9f:8c:e2:41:
+                    ed:a4:7c:9d:88:32:ae:f5:8a:84:9f:0c:18:a0:b3:
+                    fe:8e:dc:2a:88:6a:f5:2f:9c:86:92:fa:7b:6e:b3:
+                    5a:78:67:53:0b:21:6c:0d:6c:80:1a:0e:1e:ee:06:
+                    c4:d2:e7:24:c6:e5:74:be:1e:2e:17:55:2b:e5:9f:
+                    0b:a0:58:cc:fe:bf:53:37:f7:dc:95:88:f4:77:a6:
+                    59:b4:b8:7c:a2:4b:b7:6a:67:aa:84:dc:29:f1:f9:
+                    d7:89:05:4d:0b:f3:8b:2d:52:99:57:ed:6f:11:9e:
+                    af:28:a3:61:44:c2:ec:6e:7f:9f:3d:0b:dc:f7:19:
+                    6d:14:8a:a5:b8:b6:29:02:34:90:b4:96:c1:cb:a7:
+                    42:46:97:cf:8d:59:fd:17:b1:a6:27:a7:7b:8a:47:
+                    6f:fa:03:24:1c:12:25:ee:34:d6:5c:da:45:98:23:
+                    30:e1:48:c9:9a:df:37:aa:1b:70:6c:b2:0f:95:39:
+                    d6:6d:3e:25:20:a8:07:2c:48:57:0c:99:52:cb:89:
+                    08:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Authority Key Identifier: 
+                C3:12:42:BA:A9:D8:4D:E0:C3:3E:BA:D7:47:41:A6:09:2F:6D:B4:E1
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:8888/root_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:8888/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        1f:c6:fc:1c:a1:a5:6d:76:f0:7d:28:1f:e1:15:ab:86:e0:c3:
+        dd:a0:17:96:0a:c0:16:32:52:37:a4:b6:ad:24:d7:fd:3c:01:
+        34:3b:a9:a2:ea:81:05:e7:06:5f:a3:af:7b:fa:b2:a9:c3:63:
+        89:bb:0c:70:48:e9:73:cc:33:64:cd:b3:71:88:d1:d1:a1:5a:
+        22:a6:ed:03:46:8e:9a:c0:92:37:46:9b:e5:37:78:a5:43:d5:
+        46:99:1b:34:40:27:8f:95:dd:c6:9a:55:d9:60:25:8d:b8:e9:
+        6e:c9:b3:ee:e8:f0:d9:11:ef:4e:ae:1e:03:70:03:60:66:fd:
+        ab:b0:f4:74:b6:27:7c:7a:96:9d:86:58:5f:5c:d3:04:ab:16:
+        57:12:53:51:c7:93:ca:0b:4e:67:27:2d:b7:20:79:b6:b7:8c:
+        e7:c3:d9:25:5e:25:63:cf:93:f0:6e:31:c0:d5:4f:05:1c:8d:
+        14:1b:6a:d5:01:b6:7a:09:6f:38:f3:e5:e2:5a:e4:e2:42:d5:
+        8a:8d:de:ef:73:25:85:3c:e3:a9:ef:f7:f7:23:4f:d3:27:c2:
+        3a:c6:c0:6f:2a:9b:1e:fe:fc:31:73:10:e1:08:62:98:2b:6d:
+        2f:cc:ab:dd:3a:65:c2:00:7f:29:18:32:cd:8f:56:a9:1d:86:
+        f1:5e:60:55
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIUPNcW+xWZgU5T+IB8tnx3pgakPuowDQYJKoZIhvcNAQEL
+BQAwUDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRAwDgYDVQQDDAdSb290IENBMB4XDTIzMDUwMTE5
+MDE0M1oXDTMzMDQyODE5MDE0M1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
+MQ8wDQYDVQQHDAZUYWNvbWExETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJ
+bnRlcm1lZGlhdGUgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANpf/x33jRqemvMraI/BDDMGQQDJPuQa4eBwavUvrd/z6ZntxdeqkxM3/0eq88WJ
+97etOkflnE6fjOJB7aR8nYgyrvWKhJ8MGKCz/o7cKohq9S+chpL6e26zWnhnUwsh
+bA1sgBoOHu4GxNLnJMbldL4eLhdVK+WfC6BYzP6/Uzf33JWI9HemWbS4fKJLt2pn
+qoTcKfH514kFTQvziy1SmVftbxGeryijYUTC7G5/nz0L3PcZbRSKpbi2KQI0kLSW
+wcunQkaXz41Z/Rexpiene4pHb/oDJBwSJe401lzaRZgjMOFIyZrfN6obcGyyD5U5
+1m0+JSCoByxIVwyZUsuJCEECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUdVXijuetpd2A
+PckzCyyiV3ftFawwHwYDVR0jBBgwFoAUwxJCuqnYTeDDPrrXR0GmCS9ttOEwEgYD
+VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovLzEyNy4wLjAuMTo4ODg4L3Jvb3RfY3JsLmRlcjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6ODg4OC8wDQYJKoZI
+hvcNAQELBQADggEBAB/G/ByhpW128H0oH+EVq4bgw92gF5YKwBYyUjektq0k1/08
+ATQ7qaLqgQXnBl+jr3v6sqnDY4m7DHBI6XPMM2TNs3GI0dGhWiKm7QNGjprAkjdG
+m+U3eKVD1UaZGzRAJ4+V3caaVdlgJY246W7Js+7o8NkR706uHgNwA2Bm/auw9HS2
+J3x6lp2GWF9c0wSrFlcSU1HHk8oLTmcnLbcgeba3jOfD2SVeJWPPk/BuMcDVTwUc
+jRQbatUBtnoJbzjz5eJa5OJC1YqN3u9zJYU846nv9/cjT9MnwjrGwG8qmx7+/DFz
+EOEIYpgrbS/Mq906ZcIAfykYMs2PVqkdhvFeYFU=
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_cert.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_cert.pem
new file mode 100644
index 00000000..70326255
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/TestServer4_cert.pem
@@ -0,0 +1,97 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            16:5e:ab:1c:8b:dc:fc:97:d9:34:9d:fd:cd:7d:b3:3c:51:83:ce:d2
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=WA, L=Tacoma, O=Testnats, CN=Intermediate CA 2
+        Validity
+            Not Before: Aug  2 22:15:38 2023 GMT
+            Not After : Jul 30 22:15:38 2033 GMT
+        Subject: C=US, ST=WA, L=Tacoma, O=Testnats, CN=TestServer4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:fd:fb:3f:42:c7:ca:02:37:72:6e:78:d5:af:
+                    8d:b4:4d:f4:4c:0c:8f:8f:67:da:62:c0:2a:0f:f3:
+                    73:3b:83:c1:3a:df:9e:df:1d:26:12:95:41:ca:52:
+                    88:4d:8b:38:7f:78:ce:ed:aa:48:b0:dc:57:62:80:
+                    7a:fc:1f:43:c8:d8:2d:4f:38:c3:22:fc:bb:16:53:
+                    84:9e:44:0c:f9:51:00:a0:57:97:3f:df:57:08:48:
+                    3b:2b:55:b3:90:98:98:e6:a6:eb:ca:8f:ec:f8:4f:
+                    dc:4d:7e:71:2e:03:ff:cd:fa:ef:65:7e:6d:8c:35:
+                    be:df:fb:c1:0b:e9:f0:3b:89:24:4d:b4:02:7f:82:
+                    8e:0a:34:ea:a8:68:9e:f8:4b:39:9a:8f:d5:eb:bc:
+                    59:68:c9:f0:a5:eb:e9:be:7c:03:49:bd:b5:d9:54:
+                    cf:88:29:b0:2c:a3:e9:08:b6:66:37:57:ef:66:5f:
+                    6b:0f:34:6d:02:bf:92:2b:cc:e9:9d:c0:a8:92:0d:
+                    76:8f:ae:f6:3f:24:38:e9:5b:fc:12:a2:ab:fa:42:
+                    3f:5a:05:e3:5e:bb:08:43:5d:55:18:17:13:0a:27:
+                    84:5f:05:69:18:a9:45:68:37:a7:35:f9:8c:ef:c5:
+                    9f:b1:8d:aa:3c:b7:cc:47:b6:e5:85:e2:73:f5:8a:
+                    5a:71
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C4:BB:A1:42:EA:15:3E:0E:D1:48:5F:B5:E2:01:42:D0:72:BE:B0:CE
+            X509v3 Authority Key Identifier: 
+                75:55:E2:8E:E7:AD:A5:DD:80:3D:C9:33:0B:2C:A2:57:77:ED:15:AC
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://127.0.0.1:28888/intermediate2_crl.der
+            Authority Information Access: 
+                OCSP - URI:http://127.0.0.1:28888/
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        85:c2:1a:b0:94:8b:a0:f8:2c:85:1e:17:88:4e:ca:2c:d1:f6:
+        69:26:e3:a6:94:9f:62:eb:68:54:da:2b:f2:67:23:be:4b:95:
+        56:28:08:7a:52:8e:b3:b2:70:2f:c9:db:06:74:b4:8b:8e:84:
+        23:0a:74:f7:c1:67:81:69:11:36:2b:0e:4c:0f:2c:76:e6:2d:
+        50:f3:e8:59:0d:3a:6c:30:eb:31:16:74:c8:34:d1:62:97:6b:
+        1e:2f:5c:56:b0:6e:bc:5e:08:8f:d4:ce:4a:d3:8e:91:70:7d:
+        18:d4:3f:40:39:39:67:95:68:f7:16:c6:19:69:41:c2:20:2e:
+        45:e3:9d:31:c2:da:67:8d:2c:1f:a2:3f:1e:46:23:19:fd:25:
+        16:69:5c:80:09:1b:f7:7f:50:47:1d:d9:6b:aa:7b:0f:20:8d:
+        5a:f4:37:f0:c3:a7:31:5f:4d:41:70:c8:c4:aa:2a:69:d0:a8:
+        7b:3c:cc:b4:a4:12:54:a3:bf:ce:ea:22:20:58:ae:eb:29:f3:
+        15:da:22:05:46:cd:26:ef:63:84:4a:5b:86:47:fe:cb:fa:4a:
+        0c:fe:82:e0:db:81:dc:3e:87:8f:93:23:32:de:37:3d:d7:0f:
+        6c:f1:74:63:8b:11:b7:f3:69:b7:d6:e0:72:b2:1d:e1:15:10:
+        7d:2e:97:de
+-----BEGIN CERTIFICATE-----
+MIIEYjCCA0qgAwIBAgIUFl6rHIvc/JfZNJ39zX2zPFGDztIwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMQ8wDQYDVQQHDAZUYWNvbWEx
+ETAPBgNVBAoMCFRlc3RuYXRzMRowGAYDVQQDDBFJbnRlcm1lZGlhdGUgQ0EgMjAe
+Fw0yMzA4MDIyMjE1MzhaFw0zMzA3MzAyMjE1MzhaMFQxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJXQTEPMA0GA1UEBwwGVGFjb21hMREwDwYDVQQKDAhUZXN0bmF0czEU
+MBIGA1UEAwwLVGVzdFNlcnZlcjQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDV/fs/QsfKAjdybnjVr420TfRMDI+PZ9piwCoP83M7g8E6357fHSYSlUHK
+UohNizh/eM7tqkiw3FdigHr8H0PI2C1POMMi/LsWU4SeRAz5UQCgV5c/31cISDsr
+VbOQmJjmpuvKj+z4T9xNfnEuA//N+u9lfm2MNb7f+8EL6fA7iSRNtAJ/go4KNOqo
+aJ74Szmaj9XrvFloyfCl6+m+fANJvbXZVM+IKbAso+kItmY3V+9mX2sPNG0Cv5Ir
+zOmdwKiSDXaPrvY/JDjpW/wSoqv6Qj9aBeNeuwhDXVUYFxMKJ4RfBWkYqUVoN6c1
++YzvxZ+xjao8t8xHtuWF4nP1ilpxAgMBAAGjggEkMIIBIDAdBgNVHQ4EFgQUxLuh
+QuoVPg7RSF+14gFC0HK+sM4wHwYDVR0jBBgwFoAUdVXijuetpd2APckzCyyiV3ft
+FawwDAYDVR0TAQH/BAIwADARBglghkgBhvhCAQEEBAMCBsAwDgYDVR0PAQH/BAQD
+AgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9BgNVHR8ENjA0MDKg
+MKAuhixodHRwOi8vMTI3LjAuMC4xOjI4ODg4L2ludGVybWVkaWF0ZTJfY3JsLmRl
+cjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly8xMjcuMC4wLjE6
+Mjg4ODgvMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
+AAOCAQEAhcIasJSLoPgshR4XiE7KLNH2aSbjppSfYutoVNor8mcjvkuVVigIelKO
+s7JwL8nbBnS0i46EIwp098FngWkRNisOTA8sduYtUPPoWQ06bDDrMRZ0yDTRYpdr
+Hi9cVrBuvF4Ij9TOStOOkXB9GNQ/QDk5Z5Vo9xbGGWlBwiAuReOdMcLaZ40sH6I/
+HkYjGf0lFmlcgAkb939QRx3Za6p7DyCNWvQ38MOnMV9NQXDIxKoqadCoezzMtKQS
+VKO/zuoiIFiu6ynzFdoiBUbNJu9jhEpbhkf+y/pKDP6C4NuB3D6Hj5MjMt43PdcP
+bPF0Y4sRt/Npt9bgcrId4RUQfS6X3g==
+-----END CERTIFICATE-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem
new file mode 100644
index 00000000..bb0d7e45
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCaPNt2yRkPe+bT
+7dELdq4V1BEcZrhdKn3jH2XYG8RjYvZcixhmqBzCpl5y8t1XQoqrXb03tvFLUfCz
+ajfpVXgBI+pTCYMvfVk2qzNPTLzvqRzblHlMDUp8P508umx2gkcl63ki9AlseDym
+70swkCmzX7ppsRqV7VPgxiR4blKvjrzbSvAZ0gBaqLZzTBeS0Y2Bm0y4NU2R3d/T
+haafxJEZ7EfRyk4LwwaMJ0KVg+Moajt0nGiwVaWRkcs3rfrYaYveLkpRWTJLPQYh
+BGXS9YvoTUWW3mOXR4GF6kjwnSMtcYdv0nU9Rb/erUOC26Upm/leOAo5qThx7EBA
+tdxpxwtzAgMBAAECggEALjBPYLE0SgjGxWyQj6hI1cyeGy0/xNa2wE9kxmT6WPEH
+6grVkdiCVGBSJIZKdpk8wbjes1Kby/yL4o7Kk5u+xkilIZzVpmEZWF/Ii9TlN7gj
+Jja+ZGIOjkrWoZsKZCr7d4WezzLZp5wSPcOndrGVa1wdjQ02cvORjNyJi28uX9gd
+8uBK5AIXS1lbkt/v+8mrBPgZUttz6gxhlHwxKs6JWWlIpGemNddE39UxuGDGHmVA
+aw/gH/G4LNXtbAIPq5zDtFbfCKnQVgU1ppWILehoFqIs8JLtz4LPuvIxeztzKff4
+DU31rs14Zati5ykq9CVqY/d+4nKdstwhRPcPfsvgYQKBgQDBNVPn73A7fRoURpzV
+sdJPA4RDbrbiZj0x/cAskuzzx/mmJUuNyuJxGizJU0ebT3VxtdCR2LqpgGEQEaKS
+wYmMlSJ4NccugWgRl7/of5d5oY2m6f4W4YaNp4RebdVhNPJ4wSbeW7pH+2OKr2xd
+my+m1WJUvRBbPq5kV2BdHNw62QKBgQDMXTqaOjsC9jpOOIjsUHmV55MbMmwK8For
+H6e3Dn1ZO0Tpcg33GMLO5wHwzH6dlT2JVJAOdr5HqZgdIqjt30ACZsdf2VkutH94
+OvZmEAbwI9A+TAoxE8QlLYyz/qjJSGopJRU0x+KqEORxBmjO6LVV1GL9VVdoYrlH
+Z7mrJ+7RKwKBgQC87LyDS2rfgNEDipjJjPwtLy8iERzb/UVRoONNss3pA15mzIk4
+uW77UbEBnGGkyOn6quKr+tVr8ZD3+YaTIpSx1xLBoTSHkRqGOXD6k+k2knbFBIHl
+NdowoeGZxKSmTPPciGLNg7x/rp4Des3oKltKM9XXLpjT4FL+40HjStk+4QKBgQC8
+71AXd9BIy7VZzaCgwUG3GhIBadtDPbRO/AQFFAtE7KuoGz7X+/dWa3F62sQQEgKD
+LT/Fb3g5LoyoGvwMdoJp9fVLItj1egAC+pgEAbs4VhPXFFuzxa9oI7VaTwxikmU7
+RsJVOprOWbGo4KES8Ud8Y09lIHof0m2ymy2nE9MRYwKBgDn86ZcbBr6sBXgc6PEM
+rq4JXBCX8O17id9rJO37PkhPsOKpNf7YbQwHlHjwkUq5+g7Ec/LbeZ/tssEBY0ab
+zUXwgWFMUKJVTEZUFwl2aTBqW8+LSu1TgzGMx2H/sxrvS4ElxC04jpPWUQstcuRH
+y3yIz1HsmlMEg7qCiQ4maZE3
+-----END PRIVATE KEY-----
diff --git a/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer4_keypair.pem b/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer4_keypair.pem
new file mode 100644
index 00000000..97927280
--- /dev/null
+++ b/test/configs/certs/ocsp_peer/mini-ca/server2/private/TestServer4_keypair.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDV/fs/QsfKAjdy
+bnjVr420TfRMDI+PZ9piwCoP83M7g8E6357fHSYSlUHKUohNizh/eM7tqkiw3Fdi
+gHr8H0PI2C1POMMi/LsWU4SeRAz5UQCgV5c/31cISDsrVbOQmJjmpuvKj+z4T9xN
+fnEuA//N+u9lfm2MNb7f+8EL6fA7iSRNtAJ/go4KNOqoaJ74Szmaj9XrvFloyfCl
+6+m+fANJvbXZVM+IKbAso+kItmY3V+9mX2sPNG0Cv5IrzOmdwKiSDXaPrvY/JDjp
+W/wSoqv6Qj9aBeNeuwhDXVUYFxMKJ4RfBWkYqUVoN6c1+YzvxZ+xjao8t8xHtuWF
+4nP1ilpxAgMBAAECggEABmE7dr39Ep3ZDRdz0QwaNY5O6p8Dvy7llQTdZCsaDAPQ
+NJsC46w87LgoNVnbUDOGwE8n3TBS2ToCfXBu6joc5V2jkS10LOR7x+0+wpCtEdhL
+RFyEKP51u+yaXf8Aut5/zX2bwUbj9d28p89NnMV4AIo7Dau0pKXcDlW1Qk+LztyI
+hKFN6hrSFqAurmSt/pu3oo9kI9WJkrCxoj+VjQdVi420uAYOFR22aFaHrzpuHouW
+4IzFbLhVF+c33xSbs1OEIpZSFzNucWYEKSwEREcyFgIXfWpDaXjoqWcrvXkeqyo9
+vGytQ3YaEsZPzfzgcViwa30g7WAA7kO9RuwcCPK4wQKBgQDpVmbVnmTlRwFbtdkD
+4rjd5vtAB3nfsl0Ex11nU8+Oo0kZWeg8mm+Gba4vjEKfVyojbjFmm0ytQG0OGEK7
+UQ13mE1wueMn5qEVX9nTXIxVwcS7+rQAUrC5a6SSg81WIWzeclkqNc1J1EVC7jtl
+zqy3PtC94g4tV68urpD86RRxUQKBgQDqxpWscN1u7GeuYf8rSPhPcoZTupqyrV3L
+h+w7jUt5O/vfNPOYIXVfo2u05jiK0mTvLf5tVjYoQDF+x6odA2oBH2yz1ED0DZsf
+2AhdtCSrMbxazcl/5fPrIIa1GRBp6y5i0ddX8T19twr/PVoYGRqkU4xoN+KoOKz+
+HLFUUgQPIQKBgG5N9v0DDMVKRL0bAQUSN7xGxf1ly1pRUiHBMUl4WEUgsZy3YM7N
+Xu1YiiBWGOSEaxomrFnKDnxUWXlxRJKSZWBk8i7Y4SZqozmcfzeop3qeyCbpBBCn
+Bn4RAdJ1VitiT7n0qmwG1Q4St89FGXUuN33Exx8MbxFGQz05LrcwZAaRAoGAVFez
+PZfudQMI3GToPqygSCpkh3/qQ3Z008Go5FwGWS9rdOyY9nZOrGURNJPgjD65dBOZ
+672lByDIpzsjqfioBG89pf0CuKqKqA38M22cHsRnXle/o+sAjd/JhRXUB7ktmOK5
+8iYAaUFw+fEYhL/ACnjZYDdzfeueekvkiN5OBwECgYB90hQJ2lw5s6GFJd+9T5xS
+OMngfLAWDvW8+0hvtWCTLAVpMDWRGhGmvj532jWfkgqnvUemyF541RkV0Hy5K1Xl
+0icXtpuZ+REh7NCXFJlEiOd+69OEdu78s5Zy8V1zCkEsgxzl2q6PkBDWfxepgdRC
+LbwiAF8h2mxCwvvHbaBiKA==
+-----END PRIVATE KEY-----
diff --git a/test/ocsp_test.go b/test/ocsp_test.go
index be9d0bab..83808bbf 100644
--- a/test/ocsp_test.go
+++ b/test/ocsp_test.go
@@ -3685,3 +3685,284 @@ func TestOCSPLocalIssuerDetermination(t *testing.T) {
 		})
 	}
 }
+
+func TestMixedCAOCSPSuperCluster(t *testing.T) {
+	const (
+		caCert = "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+		caKey  = "configs/certs/ocsp/ca-key.pem"
+	)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	intermediateCA1Responder := newOCSPResponderIntermediateCA1(t)
+	intermediateCA1ResponderURL := fmt.Sprintf("http://%s", intermediateCA1Responder.Addr)
+	defer intermediateCA1Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA1ResponderURL, "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_cert.pem", ocsp.Good)
+
+	intermediateCA2Responder := newOCSPResponderIntermediateCA2(t)
+	intermediateCA2ResponderURL := fmt.Sprintf("http://%s", intermediateCA2Responder.Addr)
+	defer intermediateCA2Responder.Shutdown(ctx)
+	setOCSPStatus(t, intermediateCA2ResponderURL, "configs/certs/ocsp_peer/mini-ca/server2/TestServer3_cert.pem", ocsp.Good)
+
+	// Store Dirs
+	storeDirA := t.TempDir()
+	storeDirB := t.TempDir()
+	storeDirC := t.TempDir()
+
+	// Gateway server configuration
+	srvConfA := `
+		host: "127.0.0.1"
+		port: -1
+
+		server_name: "A"
+
+		ocsp { mode: "always" }
+
+		tls {
+			cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+			key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+			ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+			timeout: 5
+		}
+		store_dir: '%s'
+
+		cluster {
+			name: A
+			host: "127.0.0.1"
+			advertise: 127.0.0.1
+			port: -1
+
+			tls {
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+				timeout: 5
+			}
+		}
+
+		gateway {
+			name: A
+			host: "127.0.0.1"
+			port: -1
+			advertise: "127.0.0.1"
+
+			tls {
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+				timeout: 5
+				verify: true
+			}
+		}
+	`
+	srvConfA = fmt.Sprintf(srvConfA, storeDirA)
+	sconfA := createConfFile(t, []byte(srvConfA))
+	srvA, optsA := RunServerWithConfig(sconfA)
+	defer srvA.Shutdown()
+
+	// Server that has the original as a cluster.
+	srvConfB := `
+		host: "127.0.0.1"
+		port: -1
+
+		server_name: "B"
+
+		ocsp { mode: "always" }
+
+		tls {
+			cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+			key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+			ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+			timeout: 5
+		}
+		store_dir: '%s'
+
+		cluster {
+			name: A
+			host: "127.0.0.1"
+			advertise: 127.0.0.1
+			port: -1
+
+			routes: [ nats://127.0.0.1:%d ]
+
+			tls {
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+				timeout: 5
+			}
+		}
+
+		gateway {
+			name: A
+			host: "127.0.0.1"
+			advertise: "127.0.0.1"
+			port: -1
+
+			tls {
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server1/TestServer1_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server1/private/TestServer1_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+				timeout: 5
+				verify: true
+			}
+		}
+	`
+	srvConfB = fmt.Sprintf(srvConfB, storeDirB, optsA.Cluster.Port)
+	conf := createConfFile(t, []byte(srvConfB))
+	srvB, optsB := RunServerWithConfig(conf)
+	defer srvB.Shutdown()
+
+	// Client connects to server A.
+	cA, err := nats.Connect(fmt.Sprintf("tls://127.0.0.1:%d", optsA.Port),
+		nats.Secure(&tls.Config{
+			VerifyConnection: func(s tls.ConnectionState) error {
+				if s.OCSPResponse == nil {
+					return fmt.Errorf("missing OCSP Staple from server")
+				}
+				return nil
+			},
+		}),
+		nats.RootCAs(caCert),
+		nats.ErrorHandler(noOpErrHandler),
+	)
+	if err != nil {
+		t.Fatal(err)
+
+	}
+	defer cA.Close()
+
+	// Start another server that will make connect as a gateway to cluster A but with different CA issuer.
+	srvConfC := `
+		host: "127.0.0.1"
+		port: -1
+
+		server_name: "C"
+
+		ocsp { mode: "always" }
+
+		tls {
+			cert_file: "configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem"
+			key_file: "configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem"
+			ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+			timeout: 5
+		}
+		store_dir: '%s'
+		gateway {
+			name: C
+			host: "127.0.0.1"
+			advertise: "127.0.0.1"
+			port: -1
+			gateways: [{
+				name: "A",
+				urls: ["nats://127.0.0.1:%d"]
+				tls {
+					cert_file: "configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem"
+					key_file: "configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem"
+					ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+					timeout: 5
+				}
+			}]
+			tls {
+				cert_file: "configs/certs/ocsp_peer/mini-ca/server2/TestServer3_bundle.pem"
+				key_file: "configs/certs/ocsp_peer/mini-ca/server2/private/TestServer3_keypair.pem"
+				ca_file: "configs/certs/ocsp_peer/mini-ca/root/root_cert.pem"
+				timeout: 5
+				verify: true
+			}
+		}
+	`
+	srvConfC = fmt.Sprintf(srvConfC, storeDirC, optsA.Gateway.Port)
+	conf = createConfFile(t, []byte(srvConfC))
+	srvC, optsC := RunServerWithConfig(conf)
+	defer srvC.Shutdown()
+
+	// Check that server is connected to any server from the other cluster.
+	checkClusterFormed(t, srvA, srvB)
+	waitForOutboundGateways(t, srvC, 1, 5*time.Second)
+
+	// Connect to cluster A using server B.
+	cB, err := nats.Connect(fmt.Sprintf("tls://127.0.0.1:%d", optsB.Port),
+		nats.Secure(&tls.Config{
+			VerifyConnection: func(s tls.ConnectionState) error {
+				if s.OCSPResponse == nil {
+					return fmt.Errorf("missing OCSP Staple from server")
+				}
+				return nil
+			},
+		}),
+		nats.RootCAs(caCert),
+		nats.ErrorHandler(noOpErrHandler),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cB.Close()
+
+	// Connects to cluster C using server C.
+	cC, err := nats.Connect(fmt.Sprintf("tls://127.0.0.1:%d", optsC.Port),
+		nats.Secure(&tls.Config{
+			VerifyConnection: func(s tls.ConnectionState) error {
+				if s.OCSPResponse == nil {
+					return fmt.Errorf("missing OCSP Staple from server")
+				}
+				return nil
+			},
+		}),
+		nats.RootCAs(caCert),
+		nats.ErrorHandler(noOpErrHandler),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cC.Close()
+
+	_, err = cA.Subscribe("foo", func(m *nats.Msg) {
+		m.Respond([]byte("From Server A"))
+	})
+	if err != nil {
+		t.Errorf("%v", err)
+	}
+	cA.Flush()
+
+	_, err = cB.Subscribe("bar", func(m *nats.Msg) {
+		m.Respond([]byte("From Server B"))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cB.Flush()
+
+	// Confirm that a message from server C can flow back to server A via gateway..
+	var (
+		resp *nats.Msg
+		lerr error
+	)
+	for i := 0; i < 10; i++ {
+		resp, lerr = cC.Request("foo", nil, 500*time.Millisecond)
+		if lerr != nil {
+			continue
+		}
+		got := string(resp.Data)
+		expected := "From Server A"
+		if got != expected {
+			t.Fatalf("Expected %v, got: %v", expected, got)
+		}
+
+		// Make request to B
+		resp, lerr = cC.Request("bar", nil, 500*time.Millisecond)
+		if lerr != nil {
+			continue
+		}
+		got = string(resp.Data)
+		expected = "From Server B"
+		if got != expected {
+			t.Errorf("Expected %v, got: %v", expected, got)
+		}
+		lerr = nil
+		break
+	}
+	if lerr != nil {
+		t.Errorf("Unexpected error: %v", lerr)
+	}
+}

From af52adb1eec53ec3237d5a1218e993e83ee4e265 Mon Sep 17 00:00:00 2001
From: Byron Ruth <byron@nats.io>
Date: Thu, 3 Aug 2023 11:24:58 -0400
Subject: [PATCH 09/14] Bump Go to 1.19.12

Signed-off-by: Byron Ruth <byron@nats.io>
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 987fa0cc..c4d99e35 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ vm:
 
 language: go
 go:
-  - '1.19.11'
+  - "1.19.12"
 go_import_path: github.com/nats-io/nats-server
 
 addons:

From 081140ee67a9422b58dc586bb46666a4b9744bfd Mon Sep 17 00:00:00 2001
From: Derek Collison <derek@nats.io>
Date: Thu, 3 Aug 2023 10:41:10 -0700
Subject: [PATCH 10/14] When taking over make sure to sync and reset clfs for
 clustered streams.

Signed-off-by: Derek Collison <derek@nats.io>
---
 server/jetstream_cluster.go        |  17 ++-
 server/jetstream_cluster_3_test.go | 200 +++++++++++++++++++++++++++++
 server/stream.go                   |   8 ++
 3 files changed, 218 insertions(+), 7 deletions(-)

diff --git a/server/jetstream_cluster.go b/server/jetstream_cluster.go
index 9be5bdf1..6af4fa42 100644
--- a/server/jetstream_cluster.go
+++ b/server/jetstream_cluster.go
@@ -2291,9 +2291,13 @@ func (js *jetStream) monitorStream(mset *stream, sa *streamAssignment, sendSnaps
 
 		case isLeader = <-lch:
 			if isLeader {
-				if sendSnapshot && mset != nil && n != nil {
-					n.SendSnapshot(mset.stateSnapshot())
-					sendSnapshot = false
+				if mset != nil && n != nil {
+					// Send a snapshot if being asked or if we are tracking
+					// a failed state so that followers sync.
+					if clfs := mset.clearCLFS(); clfs > 0 || sendSnapshot {
+						n.SendSnapshot(mset.stateSnapshot())
+						sendSnapshot = false
+					}
 				}
 				if isRestore {
 					acc, _ := s.LookupAccount(sa.Client.serviceAccount())
@@ -2714,15 +2718,14 @@ func (js *jetStream) applyStreamEntries(mset *stream, ce *CommittedEntry, isReco
 
 				// Grab last sequence and CLFS.
 				last, clfs := mset.lastSeqAndCLFS()
-
 				// We can skip if we know this is less than what we already have.
 				if lseq-clfs < last {
 					s.Debugf("Apply stream entries for '%s > %s' skipping message with sequence %d with last of %d",
 						mset.account(), mset.name(), lseq+1-clfs, last)
-					// Check for any preAcks in case we are interest based.
+
 					mset.mu.Lock()
-					seq := lseq + 1 - mset.clfs
-					mset.clearAllPreAcks(seq)
+					// Check for any preAcks in case we are interest based.
+					mset.clearAllPreAcks(lseq + 1 - mset.clfs)
 					mset.mu.Unlock()
 					continue
 				}
diff --git a/server/jetstream_cluster_3_test.go b/server/jetstream_cluster_3_test.go
index 159cf269..fbf46524 100644
--- a/server/jetstream_cluster_3_test.go
+++ b/server/jetstream_cluster_3_test.go
@@ -4785,3 +4785,203 @@ func TestJetStreamAccountUsageDrifts(t *testing.T) {
 		checkAccount(sir1.State.Bytes, sir3.State.Bytes)
 	}
 }
+
+func TestJetStreamClusterStreamFailTracking(t *testing.T) {
+	c := createJetStreamClusterExplicit(t, "R3S", 3)
+	defer c.shutdown()
+
+	nc, js := jsClientConnect(t, c.randomServer())
+	defer nc.Close()
+
+	_, err := js.AddStream(&nats.StreamConfig{
+		Name:     "TEST",
+		Subjects: []string{"foo"},
+		Replicas: 3,
+	})
+	require_NoError(t, err)
+
+	m := nats.NewMsg("foo")
+	m.Data = []byte("OK")
+
+	b, bsz := 0, 5
+	sendBatch := func() {
+		for i := b * bsz; i < b*bsz+bsz; i++ {
+			msgId := fmt.Sprintf("ID:%d", i)
+			m.Header.Set(JSMsgId, msgId)
+			// Send it twice on purpose.
+			js.PublishMsg(m)
+			js.PublishMsg(m)
+		}
+		b++
+	}
+
+	sendBatch()
+
+	_, err = nc.Request(fmt.Sprintf(JSApiStreamLeaderStepDownT, "TEST"), nil, time.Second)
+	require_NoError(t, err)
+	c.waitOnStreamLeader(globalAccountName, "TEST")
+
+	sendBatch()
+
+	// Now stop one and restart.
+	nl := c.randomNonStreamLeader(globalAccountName, "TEST")
+	mset, err := nl.GlobalAccount().lookupStream("TEST")
+	require_NoError(t, err)
+	// Reset raft
+	mset.resetClusteredState(nil)
+	time.Sleep(100 * time.Millisecond)
+
+	nl.Shutdown()
+	nl.WaitForShutdown()
+
+	sendBatch()
+
+	nl = c.restartServer(nl)
+
+	sendBatch()
+
+	for {
+		_, err = nc.Request(fmt.Sprintf(JSApiStreamLeaderStepDownT, "TEST"), nil, time.Second)
+		require_NoError(t, err)
+		c.waitOnStreamLeader(globalAccountName, "TEST")
+		if nl == c.streamLeader(globalAccountName, "TEST") {
+			break
+		}
+	}
+
+	sendBatch()
+
+	_, err = js.UpdateStream(&nats.StreamConfig{
+		Name:     "TEST",
+		Subjects: []string{"foo"},
+		Replicas: 1,
+	})
+	require_NoError(t, err)
+
+	// Make sure all in order.
+	errCh := make(chan error, 100)
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	expected, seen := b*bsz, 0
+
+	sub, err := js.Subscribe("foo", func(msg *nats.Msg) {
+		expectedID := fmt.Sprintf("ID:%d", seen)
+		if v := msg.Header.Get(JSMsgId); v != expectedID {
+			errCh <- err
+			wg.Done()
+			msg.Sub.Unsubscribe()
+			return
+		}
+		seen++
+		if seen >= expected {
+			wg.Done()
+			msg.Sub.Unsubscribe()
+		}
+	})
+	require_NoError(t, err)
+	defer sub.Unsubscribe()
+
+	wg.Wait()
+	if len(errCh) > 0 {
+		t.Fatalf("Expected no errors, got %d", len(errCh))
+	}
+}
+
+func TestJetStreamClusterStreamFailTrackingSnapshots(t *testing.T) {
+	c := createJetStreamClusterExplicit(t, "R3S", 3)
+	defer c.shutdown()
+
+	nc, js := jsClientConnect(t, c.randomServer())
+	defer nc.Close()
+
+	_, err := js.AddStream(&nats.StreamConfig{
+		Name:     "TEST",
+		Subjects: []string{"foo"},
+		Replicas: 3,
+	})
+	require_NoError(t, err)
+
+	m := nats.NewMsg("foo")
+	m.Data = []byte("OK")
+
+	// Send 1000 a dupe every msgID.
+	for i := 0; i < 1000; i++ {
+		msgId := fmt.Sprintf("ID:%d", i)
+		m.Header.Set(JSMsgId, msgId)
+		// Send it twice on purpose.
+		js.PublishMsg(m)
+		js.PublishMsg(m)
+	}
+
+	// Now stop one.
+	nl := c.randomNonStreamLeader(globalAccountName, "TEST")
+	nl.Shutdown()
+	nl.WaitForShutdown()
+
+	// Now send more and make sure leader snapshots.
+	for i := 1000; i < 2000; i++ {
+		msgId := fmt.Sprintf("ID:%d", i)
+		m.Header.Set(JSMsgId, msgId)
+		// Send it twice on purpose.
+		js.PublishMsg(m)
+		js.PublishMsg(m)
+	}
+
+	sl := c.streamLeader(globalAccountName, "TEST")
+	mset, err := sl.GlobalAccount().lookupStream("TEST")
+	require_NoError(t, err)
+	node := mset.raftNode()
+	require_NotNil(t, node)
+	node.InstallSnapshot(mset.stateSnapshot())
+
+	// Now restart nl
+	nl = c.restartServer(nl)
+	c.waitOnServerCurrent(nl)
+
+	// Move leader to NL
+	for {
+		_, err = nc.Request(fmt.Sprintf(JSApiStreamLeaderStepDownT, "TEST"), nil, time.Second)
+		require_NoError(t, err)
+		c.waitOnStreamLeader(globalAccountName, "TEST")
+		if nl == c.streamLeader(globalAccountName, "TEST") {
+			break
+		}
+	}
+
+	_, err = js.UpdateStream(&nats.StreamConfig{
+		Name:     "TEST",
+		Subjects: []string{"foo"},
+		Replicas: 1,
+	})
+	require_NoError(t, err)
+
+	// Make sure all in order.
+	errCh := make(chan error, 100)
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	expected, seen := 2000, 0
+
+	sub, err := js.Subscribe("foo", func(msg *nats.Msg) {
+		expectedID := fmt.Sprintf("ID:%d", seen)
+		if v := msg.Header.Get(JSMsgId); v != expectedID {
+			errCh <- err
+			wg.Done()
+			msg.Sub.Unsubscribe()
+			return
+		}
+		seen++
+		if seen >= expected {
+			wg.Done()
+			msg.Sub.Unsubscribe()
+		}
+	})
+	require_NoError(t, err)
+	defer sub.Unsubscribe()
+
+	wg.Wait()
+	if len(errCh) > 0 {
+		t.Fatalf("Expected no errors, got %d", len(errCh))
+	}
+}
diff --git a/server/stream.go b/server/stream.go
index c9280648..6a9f6206 100644
--- a/server/stream.go
+++ b/server/stream.go
@@ -838,6 +838,14 @@ func (mset *stream) lastSeqAndCLFS() (uint64, uint64) {
 	return mset.lseq, mset.clfs
 }
 
+func (mset *stream) clearCLFS() uint64 {
+	mset.mu.Lock()
+	defer mset.mu.Unlock()
+	clfs := mset.clfs
+	mset.clfs = 0
+	return clfs
+}
+
 func (mset *stream) lastSeq() uint64 {
 	mset.mu.RLock()
 	lseq := mset.lseq

From d522f4656cd101e502b2cf3b530543a06862cea3 Mon Sep 17 00:00:00 2001
From: Derek Collison <derek@nats.io>
Date: Thu, 3 Aug 2023 11:17:51 -0700
Subject: [PATCH 11/14] Bump to 2.9.21-RC.5

Signed-off-by: Derek Collison <derek@nats.io>
---
 server/const.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/const.go b/server/const.go
index 576ef9bc..68ddd56c 100644
--- a/server/const.go
+++ b/server/const.go
@@ -41,7 +41,7 @@ var (
 
 const (
 	// VERSION is the current version for the server.
-	VERSION = "2.9.21-RC.4"
+	VERSION = "2.9.21-RC.5"
 
 	// PROTO is the currently supported protocol.
 	// 0 was the original

From cbe85c826a7af825b60a290b7a0459e44e644a77 Mon Sep 17 00:00:00 2001
From: Derek Collison <derek@nats.io>
Date: Thu, 3 Aug 2023 12:40:17 -0700
Subject: [PATCH 12/14] Also reset clseq to avoid immediate sequence mismatch

Signed-off-by: Derek Collison <derek@nats.io>
---
 server/stream.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/stream.go b/server/stream.go
index 6a9f6206..d03306d7 100644
--- a/server/stream.go
+++ b/server/stream.go
@@ -842,7 +842,7 @@ func (mset *stream) clearCLFS() uint64 {
 	mset.mu.Lock()
 	defer mset.mu.Unlock()
 	clfs := mset.clfs
-	mset.clfs = 0
+	mset.clfs, mset.clseq = 0, 0
 	return clfs
 }
 

From 8c6055babc4f35fb1fa89daacdf39c01d045c2cf Mon Sep 17 00:00:00 2001
From: Derek Collison <derek@nats.io>
Date: Thu, 3 Aug 2023 13:25:14 -0700
Subject: [PATCH 13/14] Bump to 2.9.21-RC.6

Signed-off-by: Derek Collison <derek@nats.io>
---
 server/const.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/const.go b/server/const.go
index 68ddd56c..3752f0fc 100644
--- a/server/const.go
+++ b/server/const.go
@@ -41,7 +41,7 @@ var (
 
 const (
 	// VERSION is the current version for the server.
-	VERSION = "2.9.21-RC.5"
+	VERSION = "2.9.21-RC.6"
 
 	// PROTO is the currently supported protocol.
 	// 0 was the original

From c1d1f11a18a3cc7c01e37d5caaa5a32b37531a01 Mon Sep 17 00:00:00 2001
From: Byron Ruth <byron@nats.io>
Date: Fri, 4 Aug 2023 10:11:06 -0400
Subject: [PATCH 14/14] Release v2.9.21

Signed-off-by: Byron Ruth <byron@nats.io>
---
 README.md       | 2 +-
 server/const.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4eeb391c..7809794b 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ If you are interested in contributing to NATS, read about our...
 [Fossa-Image]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Fnats-io%2Fnats-server.svg?type=shield
 [Build-Status-Url]: https://travis-ci.com/github/nats-io/nats-server
 [Build-Status-Image]: https://travis-ci.com/nats-io/nats-server.svg?branch=main
-[Release-Url]: https://github.com/nats-io/nats-server/releases/tag/v2.9.20
+[Release-Url]: https://github.com/nats-io/nats-server/releases/tag/v2.9.21
 [Release-image]: https://img.shields.io/badge/release-v2.9.20-1eb0fc.svg
 [Coverage-Url]: https://coveralls.io/r/nats-io/nats-server?branch=main
 [Coverage-image]: https://coveralls.io/repos/github/nats-io/nats-server/badge.svg?branch=main
diff --git a/server/const.go b/server/const.go
index 3752f0fc..d5789cba 100644
--- a/server/const.go
+++ b/server/const.go
@@ -41,7 +41,7 @@ var (
 
 const (
 	// VERSION is the current version for the server.
-	VERSION = "2.9.21-RC.6"
+	VERSION = "2.9.21"
 
 	// PROTO is the currently supported protocol.
 	// 0 was the original