public OCSPReq build() throws OCSPException, IOException, CertificateEncodingException {
        SecureRandom generator = checkNotNull(this.generator, "generator");
        DigestCalculator calculator = checkNotNull(this.calculator, "calculator");
        X509Certificate certificate = checkNotNull(this.certificate, "certificate");
        X509Certificate issuer = checkNotNull(this.issuer, "issuer");

        BigInteger serial = certificate.getSerialNumber();

        CertificateID certId = new CertificateID(calculator,
                new X509CertificateHolder(issuer.getEncoded()), serial);

        OCSPReqBuilder builder = new OCSPReqBuilder();
        builder.addRequest(certId);

        byte[] nonce = new byte[8];
        generator.nextBytes(nonce);

        Extension[] extensions = new Extension[] {
                new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                        new DEROctetString(nonce)) };

        builder.setRequestExtensions(new Extensions(extensions));

        return builder.build();
    }
public OCSPReq build ( ) throws OCSPException , IOException , CertificateEncodingException { SecureRandom generator = checkNotNull ( this . generator , "generator" ) ; DigestCalculator calculator = checkNotNull ( this . calculator , "calculator" ) ; X509Certificate certificate = checkNotNull ( this . certificate , "certificate" ) ; X509Certificate issuer = checkNotNull ( this . issuer , "issuer" ) ; BigInteger serial = certificate . getSerialNumber ( ) ; CertificateID certId = new CertificateID ( calculator , new X509CertificateHolder ( issuer . getEncoded ( ) ) , serial ) ; OCSPReqBuilder builder = new OCSPReqBuilder ( ) ; builder . addRequest ( certId ) ; byte [ ] nonce = new byte [ 8 ] ; generator . nextBytes ( nonce ) ; Extension [ ] extensions = new Extension [ ] { new Extension ( OCSPObjectIdentifiers . id_pkix_ocsp_nonce , false , new DEROctetString ( nonce ) ) } ; builder . setRequestExtensions ( new Extensions ( extensions ) ) ; return builder . build ( ) ; }
ATTENTION: The returned {@link OCSPReq} is not re-usable/cacheable! It contains a one-time nonce
and CA's will (should) reject subsequent requests that have the same nonce value.