Tweak the configuration files. Increase the strength of root keys to 4096 bits. Add configuration for a separate identity for the OCSP responder.