[openssl-users] Why is this OCSP response reporting a hash using SHA1?

[Robert Moskowitz]

On 09/11/2017 12:23 PM, Salz, Rich via openssl-users wrote:
>      
>      Ah,  put -sha256 in the CLIENT request.  Seems kind of backward.  Or at
>      least the server should have some control over the hash used?
>      
>
> Well, it is the client that is making the request, so therefore the client needs to hash the cert information.

Ah, I see.  I was looking at this from the wrong side.

> A production-quality OCSP responder might have configuration controls to specify which type of digests it wants to see in the request.  As with most of the OpenSSL command-line interface, it’s not a product.

Understood.  This is mostly about providing a development/testing 
environment.  And if your standard calls out use of OCSP, then you 
really should include that in testing.  I am getting ready to focus on 
the IETF SIngapore hackathon...

I would actually really like to have a SIMPLE OCSP responder.  But so 
far have not found one.  freeIPA has one buried within it, but that is 
too disruptive to install unless you buy into freeIPA.

thanks

Bob