I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support.  


Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP certificate?  
If so, does that mean an OCSP response can be forged, allowing an revoked certificate to go unnoticed by the victim?



  The signature on OCSP responses must follow the following rules to be
  considered valid by a Windows Vista or Windows Server 2008 client:
  
  For Windows Vista, either the OCSP signing certificate must be issued
  by the same CA as the certificate being verified or the OCSP response
  must be signed by the issuing CA. 
  
  For Windows Vista with Service Pack 1 and Windows Server 2008, the
  OCSP signing certificate may chain up to any trusted root CA as long
  as the certificate chain includes the OCSP Signing EKU extension.
  
  CryptoAPI will not support independent OCSP signer during revocation
  checking on this OCSP signing certificate chain to avoid circular
  dependency. CryptoAPI will support CRL and delegated OCSP signer only.
  
  We recommend that you enable the id-pkix-ocsp-nocheck
  (1.3.6.1.5.5.7.48.1.5) extension in the OCSP signing certificate so
  that no revocation checking is performed on the OCSP signing
  certificate. This ensures that a CRL is not downloaded to validate the
  OCSP signing certificate.


(source)


Question: Getting rid of "Tethering Detected" popup on Android ICS 4.0?
Answer: In the end, I rooted the phone and installed the Cyanogenmod distribution in place of the cell phone carrier's OS. :)