diff -u -r ../=httpd-2.2.11/modules/ssl/mod_ssl.c ./modules/ssl/mod_ssl.c
--- ../=httpd-2.2.11/modules/ssl/mod_ssl.c	2008-12-31 09:31:28.000000000 -0500
+++ ./modules/ssl/mod_ssl.c	2008-12-31 09:38:32.000000000 -0500
@@ -202,6 +202,9 @@
                "URL of the default OCSP Responder")
     SSL_CMD_SRV(OCSPOverrideResponder, FLAG,
                "Force use of the default responder URL (`on', `off')")
+    SSL_CMD_SRV(OCSPResponderCertificateFile, TAKE1,
+               "Trusted OCSP responder certificates"
+               "(`/path/to/file' - PEM encoded certificates)")
 
     /* Deprecated directives. */
     AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL,
diff -u -r ../=httpd-2.2.11/modules/ssl/ssl_engine_config.c ./modules/ssl/ssl_engine_config.c
--- ../=httpd-2.2.11/modules/ssl/ssl_engine_config.c	2008-12-31 09:31:28.000000000 -0500
+++ ./modules/ssl/ssl_engine_config.c	2008-12-31 09:38:32.000000000 -0500
@@ -130,6 +130,9 @@
     mctx->ocsp_enabled        = FALSE;
     mctx->ocsp_force_default  = FALSE;
     mctx->ocsp_responder      = NULL;
+    mctx->ocsp_verify_flags   = 0;
+    mctx->ocsp_certs_file     = NULL;
+    mctx->ocsp_certs          = NULL;
 }
 
 static void modssl_ctx_init_proxy(SSLSrvConfigRec *sc,
@@ -222,6 +225,7 @@
     cfgMergeBool(ocsp_enabled);
     cfgMergeBool(ocsp_force_default);
     cfgMerge(ocsp_responder, NULL);
+    cfgMerge(ocsp_certs_file, NULL);
 }
 
 static void modssl_ctx_cfg_merge_proxy(modssl_ctx_t *base,
@@ -1446,6 +1450,22 @@
     return NULL;
 }
 
+const char *ssl_cmd_SSLOCSPResponderCertificateFile(cmd_parms *cmd,
+                                            void *dcfg,
+                                            const char *arg)
+{
+    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+    const char *err;
+
+    if ((err = ssl_cmd_check_file(cmd, &arg))) {
+        return err;
+    }
+
+    sc->server->ocsp_certs_file = arg;
+
+    return NULL;
+}
+
 void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s)
 {
     if (!ap_exists_config_define("DUMP_CERTS")) {
diff -u -r ../=httpd-2.2.11/modules/ssl/ssl_engine_init.c ./modules/ssl/ssl_engine_init.c
--- ../=httpd-2.2.11/modules/ssl/ssl_engine_init.c	2008-09-18 10:34:51.000000000 -0400
+++ ./modules/ssl/ssl_engine_init.c	2008-12-31 09:38:32.000000000 -0500
@@ -974,6 +974,9 @@
         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
                      "Configuring server for SSL protocol");
         ssl_init_server_ctx(s, p, ptemp, sc);
+#ifdef HAVE_OCSP
+        ssl_init_ocsp_certificates(s, sc->server);
+#endif
     }
 
     if (sc->proxy_enabled) {
@@ -1246,6 +1249,9 @@
         ssl_init_ctx_cleanup_proxy(sc->proxy);
 
         ssl_init_ctx_cleanup_server(sc->server);
+#ifdef HAVE_OCSP
+	sk_X509_pop_free(sc->server->ocsp_certs, X509_free);
+#endif
     }
 
     return APR_SUCCESS;
diff -u -r ../=httpd-2.2.11/modules/ssl/ssl_engine_ocsp.c ./modules/ssl/ssl_engine_ocsp.c
--- ../=httpd-2.2.11/modules/ssl/ssl_engine_ocsp.c	2008-12-31 09:31:28.000000000 -0500
+++ ./modules/ssl/ssl_engine_ocsp.c	2008-12-31 09:38:32.000000000 -0500
@@ -184,7 +184,8 @@
     
     if (rc == V_OCSP_CERTSTATUS_GOOD) {
         /* TODO: allow flags configuration. */
-        if (OCSP_basic_verify(basicResponse, NULL, ctx->ctx, 0) != 1) {
+        if (OCSP_basic_verify(basicResponse, sc->server->ocsp_certs, ctx->ctx,
+                              sc->server->ocsp_verify_flags) != 1) {
             ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
             ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
 			 "failed to verify the OCSP response");
diff -u -r ../=httpd-2.2.11/modules/ssl/ssl_private.h ./modules/ssl/ssl_private.h
--- ../=httpd-2.2.11/modules/ssl/ssl_private.h	2008-12-31 09:31:28.000000000 -0500
+++ ./modules/ssl/ssl_private.h	2008-12-31 09:47:43.000000000 -0500
@@ -442,6 +442,9 @@
     BOOL ocsp_force_default; /* true if the default responder URL is
                               * used regardless of per-cert URL */
     const char *ocsp_responder; /* default responder URL */
+    int ocsp_verify_flags; /* Flags to use when verifying OCSP response */
+    const char *ocsp_certs_file; /* OCSP other certificates filename */
+    STACK_OF(X509) *ocsp_certs; /* OCSP other certificates */
 
 } modssl_ctx_t;
 
@@ -534,6 +537,7 @@
 
 const char *ssl_cmd_SSLOCSPOverrideResponder(cmd_parms *cmd, void *dcfg, int flag);
 const char *ssl_cmd_SSLOCSPDefaultResponder(cmd_parms *cmd, void *dcfg, const char *arg);
+const char *ssl_cmd_SSLOCSPResponderCertificateFile(cmd_parms *cmd, void *dcfg, const char *arg);
 const char *ssl_cmd_SSLOCSPEnable(cmd_parms *cmd, void *dcfg, int flag);
 
 /**  module initialization  */
@@ -694,7 +698,8 @@
 OCSP_RESPONSE *modssl_dispatch_ocsp_request(const apr_uri_t *uri, 
                                             OCSP_REQUEST *request,
                                             conn_rec *c, apr_pool_t *p);
-
+/* Initialize OCSP trusted certificate list */
+void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx);
 #endif /* SSL_PRIVATE_H */
 /** @} */
 
diff -u -r ../=httpd-2.2.11/modules/ssl/ssl_util_ocsp.c ./modules/ssl/ssl_util_ocsp.c
--- ../=httpd-2.2.11/modules/ssl/ssl_util_ocsp.c	2008-12-31 09:31:28.000000000 -0500
+++ ./modules/ssl/ssl_util_ocsp.c	2008-12-31 09:51:07.000000000 -0500
@@ -290,3 +290,81 @@
 
     return response;
 }
+
+/*  _________________________________________________________________
+**
+**  OCSP other certificate support
+**  _________________________________________________________________
+*/
+
+/*
+ * Read a file that contains certificates in PEM format and
+ * return as a STACK.
+ */
+static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file)
+{
+    BIO *bio;
+    X509 *x509;
+    unsigned long err;
+    int n;
+    STACK_OF(X509) *other_certs = NULL;
+
+    if ((bio = BIO_new(BIO_s_file_internal())) == NULL)
+        return NULL;
+    if (BIO_read_filename(bio, file) <= 0) {
+        BIO_free(bio);
+        return NULL;
+    }
+    /* create new extra chain by loading the certs */
+    while ((x509 = modssl_PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
+	if (!other_certs) {
+		other_certs = sk_X509_new_null();
+		if (!other_certs)
+			return NULL;
+	}
+		
+        if (!sk_X509_push(other_certs, x509)) {
+            X509_free(x509);
+            sk_X509_pop_free(other_certs, X509_free);
+            BIO_free(bio);
+            return NULL;
+        }
+    }
+    /* Make sure that only the error is just an EOF */
+    if ((err = ERR_peek_error()) > 0) {
+        if (!(   ERR_GET_LIB(err) == ERR_LIB_PEM
+              && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
+            BIO_free(bio);
+            sk_X509_pop_free(other_certs, X509_free);
+            return NULL;
+        }
+        while (ERR_get_error() > 0) ;
+    }
+    BIO_free(bio);
+    return other_certs;
+}
+
+void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx)
+{
+    /*
+     * Configure Trusted OCSP certificates.
+     */
+
+    if (!mctx->ocsp_certs_file) {
+        return;
+    }
+
+    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+                 "Configuring Trusted OCSP certificates");
+
+    mctx->ocsp_certs = modssl_read_ocsp_certificates(mctx->ocsp_certs_file);
+
+    if (!mctx->ocsp_certs) {
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                "Unable to configure OCSP Trusted Certificates");
+        ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
+        ssl_die();
+    }
+    mctx->ocsp_verify_flags |= OCSP_TRUSTOTHER;
+}
+
