public static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber)
            throws CertificateVerificationException {

        //Programatically adding Bouncy Castle as the security provider. So no need to manually set. Once the programme
        // is over security provider will also be removed.
        Security.addProvider(new BouncyCastleProvider());
        try {

            byte[] issuerCertEnc = issuerCert.getEncoded();
            X509CertificateHolder certificateHolder = new X509CertificateHolder(issuerCertEnc);
            DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
                    .setProvider(Constants.BOUNCY_CASTLE_PROVIDER).build();

            //  CertID structure is used to uniquely identify certificates that are the subject of
            // an OCSP request or response and has an ASN.1 definition. CertID structure is defined in RFC 2560.
            CertificateID id = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1), certificateHolder,
                    serialNumber);

            // basic request generation with nonce.
            OCSPReqBuilder builder = new OCSPReqBuilder();
            builder.addRequest(id);

            // create details for nonce extension. The nonce extension is used to bind
            // a request to a response to prevent re-play attacks. As the name implies,
            // the nonce value is something that the client should only use once during a reasonably small period.
            BigInteger nonce = BigInteger.valueOf(System.currentTimeMillis());

            //to create the request Extension
            builder.setRequestExtensions(new Extensions(new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                    new DEROctetString(nonce.toByteArray()))));

            return builder.build();

        } catch (OCSPException | OperatorCreationException | IOException | CertificateEncodingException e) {
            throw new CertificateVerificationException("Cannot generate OCSP Request with the given certificate", e);
        }
    }
public static OCSPReq generateOCSPRequest ( X509Certificate issuerCert , BigInteger serialNumber ) throws CertificateVerificationException { Security . addProvider ( new BouncyCastleProvider ( ) ) ; try { byte [ ] issuerCertEnc = issuerCert . getEncoded ( ) ; X509CertificateHolder certificateHolder = new X509CertificateHolder ( issuerCertEnc ) ; DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder ( ) . setProvider ( Constants . BOUNCY_CASTLE_PROVIDER ) . build ( ) ; CertificateID id = new CertificateID ( digCalcProv . get ( CertificateID . HASH_SHA1 ) , certificateHolder , serialNumber ) ; OCSPReqBuilder builder = new OCSPReqBuilder ( ) ; builder . addRequest ( id ) ; BigInteger nonce = BigInteger . valueOf ( System . currentTimeMillis ( ) ) ; builder . setRequestExtensions ( new Extensions ( new Extension ( OCSPObjectIdentifiers . id_pkix_ocsp_nonce , false , new DEROctetString ( nonce . toByteArray ( ) ) ) ) ) ; return builder . build ( ) ; } catch ( OCSPException | OperatorCreationException | IOException | CertificateEncodingException e ) { throw new CertificateVerificationException ( "Cannot generate OCSP Request with the given certificate" , e ) ; } }
This method generates an OCSP Request to be sent to an OCSP authority access endpoint.

@param issuerCert the Issuer's certificate of the peer certificate we are interested in.
@param serialNumber of the peer certificate.
@return generated OCSP request.
@throws CertificateVerificationException if any error occurs while generating ocsp request.