code: public OCSPReq build() throws OCSPException, IOException, CertificateEncodingException {
          SecureRandom generator = checkNotNull(this.generator, "generator");
          DigestCalculator calculator = checkNotNull(this.calculator, "calculator");
          X509Certificate certificate = checkNotNull(this.certificate, "certificate");
          X509Certificate issuer = checkNotNull(this.issuer, "issuer");
  
          BigInteger serial = certificate.getSerialNumber();
  
          CertificateID certId = new CertificateID(calculator,
                  new X509CertificateHolder(issuer.getEncoded()), serial);
  
          OCSPReqBuilder builder = new OCSPReqBuilder();
          builder.addRequest(certId);
  
          byte[] nonce = new byte[8];
          generator.nextBytes(nonce);
  
          Extension[] extensions = new Extension[] {
                  new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                          new DEROctetString(nonce)) };
  
          builder.setRequestExtensions(new Extensions(extensions));
  
          return builder.build();
      }
docs: ATTENTION: The returned {@link OCSPReq} is not re-usable/cacheable! It contains a one-time nonce
  and CA's will (should) reject subsequent requests that have the same nonce value.