Section 7.3.2 of the BRs says: ''The singleExtensions of an OCSP response MUST NOT contain the reasonCode (OID 2.5.29.21) CRL entry extension.''
== certificateHold ==The BRs say the followingin relation to certificateHold:
* Section 7.2.2: ''the CRLReason MUST NOT be certificateHold''
* Section 7.3 (OCSP Profile): ''the CRLReason indicated MUST contain a value permitted for CRLs, as specified in Section 7.2.2.''