code: public static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber)
              throws CertificateVerificationException {
  
          //Programatically adding Bouncy Castle as the security provider. So no need to manually set. Once the programme
          // is over security provider will also be removed.
          Security.addProvider(new BouncyCastleProvider());
          try {
  
              byte[] issuerCertEnc = issuerCert.getEncoded();
              X509CertificateHolder certificateHolder = new X509CertificateHolder(issuerCertEnc);
              DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
                      .setProvider(Constants.BOUNCY_CASTLE_PROVIDER).build();
  
              //  CertID structure is used to uniquely identify certificates that are the subject of
              // an OCSP request or response and has an ASN.1 definition. CertID structure is defined in RFC 2560.
              CertificateID id = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1), certificateHolder,
                      serialNumber);
  
              // basic request generation with nonce.
              OCSPReqBuilder builder = new OCSPReqBuilder();
              builder.addRequest(id);
  
              // create details for nonce extension. The nonce extension is used to bind
              // a request to a response to prevent re-play attacks. As the name implies,
              // the nonce value is something that the client should only use once during a reasonably small period.
              BigInteger nonce = BigInteger.valueOf(System.currentTimeMillis());
  
              //to create the request Extension
              builder.setRequestExtensions(new Extensions(new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
                      new DEROctetString(nonce.toByteArray()))));
  
              return builder.build();
  
          } catch (OCSPException | OperatorCreationException | IOException | CertificateEncodingException e) {
              throw new CertificateVerificationException("Cannot generate OCSP Request with the given certificate", e);
          }
      }
docs: This method generates an OCSP Request to be sent to an OCSP authority access endpoint.
  
  @param issuerCert the Issuer's certificate of the peer certificate we are interested in.
  @param serialNumber of the peer certificate.
  @return generated OCSP request.
  @throws CertificateVerificationException if any error occurs while generating ocsp request.