What does the OCSP nonce extension protect against?

Replay: the client puts a fresh random number in its request and the responder must sign it into the response, so an attacker cannot resend an old "good" answer.

OCSP responses are signed, so they cannot be forged, but a genuine one can be recorded and replayed. An attacker who captured a "good" response for a certificate before it was revoked could feed that old response to the verifier later and make a revoked certificate look valid.

With a nonce (a number used once), the verifier generates a random value per request. The responder copies it into the signed response. The verifier accepts only a response that carries its current nonce, which proves the answer was made for this request, now.

Trade-off: a nonce prevents responders from serving pre-computed, cached responses (each must be signed live), which is why many large public responders ignore nonces and rely on short response validity times instead.

In the CKTECK setup Apache sends nonces by default (SSLOCSPUseRequestNonce on), so the Windows responder must have "NONCE extension support" enabled, otherwise the exchange fails. Alternatively Apache could be told not to send one.

Go deeper:

• Apache: mod_ssl SSLOCSPUseRequestNonce — the directive that controls the nonce on the web server side.
• Wikipedia: Replay attack — the attack class nonces defend against.
• Wikipedia: Cryptographic nonce — nonces in authentication protocols.