code: func sendOCSPRequest(server string, req []byte, leaf, issuer *x509.Certificate) (*ocsp.Response, error) {
  	var resp *http.Response
  	var err error
  	if len(req) > 256 {
  		buf := bytes.NewBuffer(req)
  		resp, err = http.Post(server, "application/ocsp-request", buf)
  	} else {
  		reqURL := server + "/" + base64.StdEncoding.EncodeToString(req)
  		resp, err = http.Get(reqURL)
  	}
  
  	if err != nil {
  		return nil, err
  	}
  
  	if resp.StatusCode != http.StatusOK {
  		return nil, errors.New("failed to retrieve OSCP")
  	}
  
  	body, err := ocspRead(resp.Body)
  	if err != nil {
  		return nil, err
  	}
  	resp.Body.Close()
  
  	switch {
  	case bytes.Equal(body, ocsp.UnauthorizedErrorResponse):
  		return nil, errors.New("OSCP unauthorized")
  	case bytes.Equal(body, ocsp.MalformedRequestErrorResponse):
  		return nil, errors.New("OSCP malformed")
  	case bytes.Equal(body, ocsp.InternalErrorErrorResponse):
  		return nil, errors.New("OSCP internal error")
  	case bytes.Equal(body, ocsp.TryLaterErrorResponse):
  		return nil, errors.New("OSCP try later")
  	case bytes.Equal(body, ocsp.SigRequredErrorResponse):
  		return nil, errors.New("OSCP signature required")
  	}
  
  	return ocsp.ParseResponseForCert(body, leaf, issuer)
  }
docs: // sendOCSPRequest attempts to request an OCSP response from the
  // server. The error only indicates a failure to *fetch* the
  // certificate, and *does not* mean the certificate is valid.