docs: private OCSPResp fetchOcspResponse(
        SFPair<Certificate, Certificate> pairIssuerSubject, OCSPReq req,
        String cid_enc, String hname)
    throws CertificateEncodingException
    {
      try
      {
        byte[] ocspReqDer = req.getEncoded();
        String ocspReqDerBase64 = Base64.encodeBase64String(ocspReqDer);
  
        Set<String> ocspUrls = getOcspUrls(pairIssuerSubject.right);
        String ocspUrlStr = ocspUrls.iterator().next(); // first one
        URL url;
  
        if (!ocspCacheServer.new_endpoint_enabled)
        {
          if (SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN != null)
          {
            URL ocspUrl = new URL(ocspUrlStr);
            url = new URL(String.format(
                SF_OCSP_RESPONSE_CACHE_SERVER_RETRY_URL_PATTERN,
                ocspUrl.getHost(), ocspReqDerBase64));
          }
          else
          {
            url = new URL(String.format("%s/%s", ocspUrlStr, ocspReqDerBase64));
          }
  
          LOGGER.debug(
              "not hit cache. Fetching OCSP response from CA OCSP server. {}", url.toString());
        }
        else
        {
          url = new URL(ocspCacheServer.SF_OCSP_RESPONSE_RETRY_URL);
          LOGGER.debug(
              "not hit cache. Fetching OCSP response from Snowflake OCSP Response Fetcher. {}", url.toString());
        }
  
        long sleepTime = INITIAL_SLEEPING_TIME_IN_MILLISECONDS;
        DecorrelatedJitterBackoff backoff = new DecorrelatedJitterBackoff(
            sleepTime, MAX_SLEEPING_TIME_IN_MILLISECONDS);
        boolean success = false;
        HttpResponse response = null;
  
        for (int retry = 0; retry < MAX_RETRY_COUNTER; ++retry)
        {
          if (!ocspCacheServer.new_endpoint_enabled)
          {
            HttpClient client = getHttpClient();
            HttpGet get = new HttpGet(url.toString());
            response = client.execute(get);
          }
          else
          {
            HttpClient client = getHttpClient();
            HttpPost post = new HttpPost(url.toString());
            post.setHeader("Content-Type", "application/json");
            SFTrustManager.OCSPPostReqData postReqData =
                new SFTrustManager.OCSPPostReqData(ocspUrlStr,
                                                   ocspReqDerBase64,
                                                   cid_enc,
                                                   hname);
            String json_payload = OBJECT_MAPPER.writeValueAsString(postReqData);
            post.setEntity(new StringEntity(json_payload, "utf-8"));
            response = client.execute(post);
  
          }
  
          if (response != null && response.getStatusLine().getStatusCode() == HttpStatus.SC_OK)
          {
            success = true;
            LOGGER.debug(
                "Successfully downloaded OCSP response from CA server. " +
                "URL: {}", url.toString());
            break;
          }
          LOGGER.debug("Retrying {}/{} after sleeping {}(ms)",
                       retry + 1, MAX_RETRY_COUNTER, sleepTime);
          try
          {
            Thread.sleep(sleepTime);
            sleepTime = backoff.nextSleepTime(sleepTime);
          }
          catch (InterruptedException ex0)
          { // nop
          }
        }
        if (!success)
        {
          throw new CertificateEncodingException(
              String.format(
                  "Failed to get OCSP response. StatusCode: %d, URL: %s",
                  response == null ? null : response.getStatusLine().getStatusCode(),
                  ocspUrlStr));
        }
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        IOUtils.copy(response.getEntity().getContent(), out);
        OCSPResp ocspResp = new OCSPResp(out.toByteArray());
        if (ocspResp.getStatus() != OCSPResp.SUCCESSFUL)
        {
          throw new CertificateEncodingException(
              String.format("Failed to get OCSP response. Status: %s",
                            OCSP_RESPONSE_CODE_TO_STRING.get(ocspResp.getStatus())));
        }
  
        return ocspResp;
      }
      catch (IOException ex)
      {
        throw new CertificateEncodingException("Failed to encode object.", ex);
      }
    }