diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1f856f93..c27e2520 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -16,16 +16,16 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: java
         queries: +security-and-quality
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/coverity-analysis.yml b/.github/workflows/coverity-analysis.yml
index 8604821b..61838e7a 100644
--- a/.github/workflows/coverity-analysis.yml
+++ b/.github/workflows/coverity-analysis.yml
@@ -15,15 +15,15 @@ jobs:
       PROJECTNAME: 'web-eid/web-eid-authtoken-validation-java'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: zulu
           java-version: 8
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
@@ -50,4 +50,4 @@ jobs:
             --form file=@upload.tgz \
             --form version=master \
             --form description="Github Actions CI build" \
-            https://scan.coverity.com/builds?project=$PROJECTNAME
\ No newline at end of file
+            https://scan.coverity.com/builds?project=$PROJECTNAME
diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml
index ecbd17a3..8e55facb 100644
--- a/.github/workflows/maven-build.yml
+++ b/.github/workflows/maven-build.yml
@@ -7,15 +7,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: zulu
           java-version: 8
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/maven-deploy.yml b/.github/workflows/maven-deploy.yml
index d5c5d29e..fcb46c00 100644
--- a/.github/workflows/maven-deploy.yml
+++ b/.github/workflows/maven-deploy.yml
@@ -9,15 +9,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: zulu
           java-version: 8
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/sonarcloud-analysis.yml b/.github/workflows/sonarcloud-analysis.yml
index dd85e358..374c7c8b 100644
--- a/.github/workflows/sonarcloud-analysis.yml
+++ b/.github/workflows/sonarcloud-analysis.yml
@@ -9,22 +9,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: Set up JDK 11
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: zulu
           java-version: 11
       - name: Cache SonarCloud packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-v11-${{ hashFiles('**/pom.xml') }}
diff --git a/LICENSE b/LICENSE
index 326ac324..a7252dec 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2023 Estonian Information System Authority
+Copyright (c) 2020-2025 Estonian Information System Authority
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/pom.xml b/pom.xml
index 8fac8355..94030f10 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,25 +4,25 @@
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>authtoken-validation</artifactId>
-    <groupId>org.webeid.security</groupId>
-    <version>2.1.2</version>
+    <groupId>eu.webeid.security</groupId>
+    <version>2.2.0</version>
     <packaging>jar</packaging>
     <name>authtoken-validation</name>
     <description>Web eID authentication token validation library for Java</description>
 
     <properties>
         <maven.version>3.3.9</maven.version>
-        <maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
+        <maven-surefire-plugin.version>3.5.4</maven-surefire-plugin.version>
         <java.version>1.8</java.version>
-        <jjwt.version>0.11.5</jjwt.version>
-        <jackson.version>2.13.4.2</jackson.version>
-        <slf4j.version>1.7.36</slf4j.version>
-        <bouncycastle.version>1.70</bouncycastle.version>
-        <okhttp.version>4.10.0</okhttp.version>
-        <junit-jupiter.version>5.8.2</junit-jupiter.version>
-        <assertj.version>3.23.1</assertj.version>
-        <mockito.version>4.6.1</mockito.version>
-        <jacoco.version>0.8.5</jacoco.version>
+        <jjwt.version>0.13.0</jjwt.version>
+        <jackson.version>2.18.5</jackson.version>
+        <slf4j.version>2.0.17</slf4j.version>
+        <bouncycastle.version>1.82</bouncycastle.version>
+        <okhttp.version>5.3.0</okhttp.version>
+        <junit-jupiter.version>5.12.0</junit-jupiter.version>
+        <assertj.version>3.27.3</assertj.version>
+        <mockito.version>4.11.0</mockito.version>
+        <jacoco.version>0.8.12</jacoco.version>
         <sonar.coverage.jacoco.xmlReportPaths>
             ${project.basedir}/../jacoco-coverage-report/target/site/jacoco-aggregate/jacoco.xml
         </sonar.coverage.jacoco.xmlReportPaths>
@@ -56,17 +56,17 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
+            <artifactId>bcprov-jdk18on</artifactId>
             <version>${bouncycastle.version}</version>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
+            <artifactId>bcpkix-jdk18on</artifactId>
             <version>${bouncycastle.version}</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
-            <artifactId>okhttp</artifactId>
+            <artifactId>okhttp-jvm</artifactId>
             <version>${okhttp.version}</version>
         </dependency>
 
@@ -84,7 +84,7 @@
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
-            <artifactId>mockito-core</artifactId>
+            <artifactId>mockito-inline</artifactId>
             <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
@@ -129,7 +129,7 @@
 
     <!-- For publishing the library to GitHub Packages/GitLab Package Repository -->
     <distributionManagement>
-        <!-- Github Packages does not currently support public access, so disabled until it does.
+        <!-- GitHub Packages does not currently support public access, so disabled until it does.
              See https://github.community/t/download-from-github-package-registry-without-authentication/14407
         <repository>
             <id>github</id>
diff --git a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java
index 5bb777f3..77d80bc4 100644
--- a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java
+++ b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/certificate/CertificateData.java b/src/main/java/eu/webeid/security/certificate/CertificateData.java
index aad1ceeb..f9486831 100644
--- a/src/main/java/eu/webeid/security/certificate/CertificateData.java
+++ b/src/main/java/eu/webeid/security/certificate/CertificateData.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -32,43 +32,44 @@
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
+import java.util.Optional;
 import java.util.stream.Collectors;
 
 public final class CertificateData {
 
-    public static String getSubjectCN(X509Certificate certificate) throws CertificateEncodingException {
+    public static Optional<String> getSubjectCN(X509Certificate certificate) throws CertificateEncodingException {
         return getSubjectField(certificate, BCStyle.CN);
     }
 
-    public static String getSubjectSurname(X509Certificate certificate) throws CertificateEncodingException {
+    public static Optional<String> getSubjectSurname(X509Certificate certificate) throws CertificateEncodingException {
         return getSubjectField(certificate, BCStyle.SURNAME);
     }
 
-    public static String getSubjectGivenName(X509Certificate certificate) throws CertificateEncodingException {
+    public static Optional<String> getSubjectGivenName(X509Certificate certificate) throws CertificateEncodingException {
         return getSubjectField(certificate, BCStyle.GIVENNAME);
     }
 
-    public static String getSubjectIdCode(X509Certificate certificate) throws CertificateEncodingException {
+    public static Optional<String> getSubjectIdCode(X509Certificate certificate) throws CertificateEncodingException {
         return getSubjectField(certificate, BCStyle.SERIALNUMBER);
     }
 
-    public static String getSubjectCountryCode(X509Certificate certificate) throws CertificateEncodingException {
+    public static Optional<String> getSubjectCountryCode(X509Certificate certificate) throws CertificateEncodingException {
         return getSubjectField(certificate, BCStyle.C);
     }
 
-    private static String getSubjectField(X509Certificate certificate, ASN1ObjectIdentifier fieldId) throws CertificateEncodingException {
+    private static Optional<String> getSubjectField(X509Certificate certificate, ASN1ObjectIdentifier fieldId) throws CertificateEncodingException {
         return getField(new JcaX509CertificateHolder(certificate).getSubject(), fieldId);
     }
 
-    private static String getField(X500Name x500Name, ASN1ObjectIdentifier fieldId) throws CertificateEncodingException {
+    private static Optional<String> getField(X500Name x500Name, ASN1ObjectIdentifier fieldId) {
         // Example value: [C=EE, CN=JÕEORG\,JAAK-KRISTJAN\,38001085718, 2.5.4.4=#0c074ac395454f5247, 2.5.4.42=#0c0d4a41414b2d4b524953544a414e, 2.5.4.5=#1311504e4f45452d3338303031303835373138]
         final RDN[] rdns = x500Name.getRDNs(fieldId);
         if (rdns.length == 0 || rdns[0].getFirst() == null) {
-            throw new CertificateEncodingException("X500 name RDNs empty or first element is null");
+            return Optional.empty();
         }
-        return Arrays.stream(rdns)
+        return Optional.of(Arrays.stream(rdns)
             .map(rdn -> IETFUtils.valueToString(rdn.getFirst().getValue()))
-            .collect(Collectors.joining(", "));
+            .collect(Collectors.joining(", ")));
     }
 
     private CertificateData() {
diff --git a/src/main/java/eu/webeid/security/certificate/CertificateLoader.java b/src/main/java/eu/webeid/security/certificate/CertificateLoader.java
index 9c4c9727..0da0a670 100644
--- a/src/main/java/eu/webeid/security/certificate/CertificateLoader.java
+++ b/src/main/java/eu/webeid/security/certificate/CertificateLoader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java
index 3aafd766..f9d90afa 100644
--- a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java
+++ b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -23,9 +23,9 @@
 package eu.webeid.security.certificate;
 
 import eu.webeid.security.exceptions.CertificateExpiredException;
+import eu.webeid.security.exceptions.CertificateNotTrustedException;
 import eu.webeid.security.exceptions.CertificateNotYetValidException;
 import eu.webeid.security.exceptions.JceException;
-import eu.webeid.security.exceptions.CertificateNotTrustedException;
 
 import java.security.GeneralSecurityException;
 import java.security.InvalidAlgorithmParameterException;
@@ -57,16 +57,12 @@ public static void certificateIsValidOnDate(X509Certificate cert, Date date, Str
         }
     }
 
-    public static void trustedCACertificatesAreValidOnDate(Set<TrustAnchor> trustedCACertificateAnchors, Date date) throws CertificateNotYetValidException, CertificateExpiredException {
-        for (TrustAnchor cert : trustedCACertificateAnchors) {
-            certificateIsValidOnDate(cert.getTrustedCert(), date, "Trusted CA");
-        }
-    }
-
     public static X509Certificate validateIsSignedByTrustedCA(X509Certificate certificate,
                                                               Set<TrustAnchor> trustedCACertificateAnchors,
                                                               CertStore trustedCACertificateCertStore,
-                                                              Date date) throws CertificateNotTrustedException, JceException {
+                                                              Date now) throws CertificateNotTrustedException, JceException, CertificateNotYetValidException, CertificateExpiredException {
+        certificateIsValidOnDate(certificate, now, "User");
+
         final X509CertSelector selector = new X509CertSelector();
         selector.setCertificate(certificate);
 
@@ -74,14 +70,19 @@ public static X509Certificate validateIsSignedByTrustedCA(X509Certificate certif
             final PKIXBuilderParameters pkixBuilderParameters = new PKIXBuilderParameters(trustedCACertificateAnchors, selector);
             // Certificate revocation check is intentionally disabled as we do the OCSP check with SubjectCertificateNotRevokedValidator ourselves.
             pkixBuilderParameters.setRevocationEnabled(false);
-            pkixBuilderParameters.setDate(date);
+            pkixBuilderParameters.setDate(now);
             pkixBuilderParameters.addCertStore(trustedCACertificateCertStore);
 
             // See the comment in buildCertStoreFromCertificates() below why we use the default JCE provider.
             final CertPathBuilder certPathBuilder = CertPathBuilder.getInstance(CertPathBuilder.getDefaultType());
             final PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) certPathBuilder.build(pkixBuilderParameters);
 
-            return result.getTrustAnchor().getTrustedCert();
+            final X509Certificate trustedCACert = result.getTrustAnchor().getTrustedCert();
+
+            // Verify that the trusted CA cert is presently valid before returning the result.
+            certificateIsValidOnDate(trustedCACert, now, "Trusted CA");
+
+            return trustedCACert;
 
         } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException e) {
             throw new JceException(e);
diff --git a/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java b/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java
index da578d5e..19ee8d78 100644
--- a/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java
+++ b/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java
index b4e92185..23f33222 100644
--- a/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java
+++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java
index b70f1534..d32d9a86 100644
--- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java
+++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java
index 2c843312..11da37b8 100644
--- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java
+++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java
index 5526cb03..dd80be87 100644
--- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java
+++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java
index bdd34efc..2631cf86 100644
--- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java
+++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java
index 9f2e8c72..1e270cb4 100644
--- a/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java
+++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java
index 68508402..810824e6 100644
--- a/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java
+++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java
index 066617bd..192b6fd5 100644
--- a/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java
+++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java b/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java
index 99be6d31..71d5dbe4 100644
--- a/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java
+++ b/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java b/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java
index 4d16c264..ea3de153 100644
--- a/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java
+++ b/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java b/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java
index ad13b3ff..02e44bdb 100644
--- a/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java
+++ b/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -30,7 +30,7 @@
 public class CertificateNotTrustedException extends AuthTokenException {
 
     public CertificateNotTrustedException(X509Certificate certificate, Throwable e) {
-        super("Certificate " + certificate.getSubjectDN() + " is not trusted", e);
+        super("Certificate " + certificate.getSubjectX500Principal() + " is not trusted", e);
     }
 
 }
diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java b/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java
index 7d658bd6..90b967fd 100644
--- a/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java
+++ b/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java
index 2955d0c6..ca5e23c6 100644
--- a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java
+++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java
index 6456307a..a2312123 100644
--- a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java
+++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java
index 0bf1ba8f..08037248 100644
--- a/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java
+++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/JceException.java b/src/main/java/eu/webeid/security/exceptions/JceException.java
index d597c6a2..b9da794a 100644
--- a/src/main/java/eu/webeid/security/exceptions/JceException.java
+++ b/src/main/java/eu/webeid/security/exceptions/JceException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java b/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java
index 5ec050a2..397cf23f 100644
--- a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java
+++ b/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java
index b5d97255..a25418b8 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java
index abce3aa1..4e3887e3 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java
index a943f201..5ca68dc5 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java
index 6e3c136f..49c43885 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java
index 9d451a4d..83eb53ab 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java
index 3ef77132..884280b4 100644
--- a/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java
+++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/util/Base64Decoder.java b/src/main/java/eu/webeid/security/util/Base64Decoder.java
index d359eca0..97aa20af 100644
--- a/src/main/java/eu/webeid/security/util/Base64Decoder.java
+++ b/src/main/java/eu/webeid/security/util/Base64Decoder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/util/Collections.java b/src/main/java/eu/webeid/security/util/Collections.java
index 0ddfe3e1..585cb6c4 100644
--- a/src/main/java/eu/webeid/security/util/Collections.java
+++ b/src/main/java/eu/webeid/security/util/Collections.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/util/DateAndTime.java b/src/main/java/eu/webeid/security/util/DateAndTime.java
index 5d052cc6..97b33aad 100644
--- a/src/main/java/eu/webeid/security/util/DateAndTime.java
+++ b/src/main/java/eu/webeid/security/util/DateAndTime.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -45,8 +45,14 @@ public static void requirePositiveDuration(Duration duration, String fieldName)
 
     public static class DefaultClock implements Clock {
 
-        public static final Clock INSTANCE = new DefaultClock();
+        // Allows mocking of time-dependent behavior with Mockito.mockStatic() in tests.
+        private static final Clock instance = new DefaultClock();
 
+        public static Clock getInstance() {
+            return instance;
+        }
+
+        @Override
         public Date now() {
             return new Date();
         }
diff --git a/src/main/java/eu/webeid/security/util/Strings.java b/src/main/java/eu/webeid/security/util/Strings.java
index 17c60b87..1e37f2e9 100644
--- a/src/main/java/eu/webeid/security/util/Strings.java
+++ b/src/main/java/eu/webeid/security/util/Strings.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java
index 9b87e474..a0e1f616 100644
--- a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java
+++ b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -25,11 +25,12 @@
 import eu.webeid.security.exceptions.AuthTokenParseException;
 import eu.webeid.security.exceptions.AuthTokenSignatureValidationException;
 import eu.webeid.security.exceptions.ChallengeNullOrEmptyException;
-import io.jsonwebtoken.SignatureAlgorithm;
-import io.jsonwebtoken.impl.crypto.DefaultSignatureValidatorFactory;
-import io.jsonwebtoken.impl.crypto.SignatureValidator;
-import io.jsonwebtoken.security.SignatureException;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.impl.security.DefaultVerifySecureDigestRequest;
+import io.jsonwebtoken.security.SignatureAlgorithm;
+import io.jsonwebtoken.security.VerifySecureDigestRequest;
 
+import java.io.ByteArrayInputStream;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -73,25 +74,20 @@ public void validate(String algorithm, String signature, PublicKey publicKey, St
             throw new AuthTokenParseException("Unsupported signature algorithm");
         }
 
-        SignatureAlgorithm signatureAlgorithm;
+        final SignatureAlgorithm signatureAlgorithm = (SignatureAlgorithm) Jwts.SIG.get().forKey(algorithm);
+        if (signatureAlgorithm == null) {
+            // Should not happen, see ALLOWED_SIGNATURE_ALGORITHMS check above.
+            throw new AuthTokenParseException("JJWT does not support signature algorithm: " + algorithm);
+        }
         MessageDigest hashAlgorithm;
         try {
-            signatureAlgorithm = SignatureAlgorithm.forName(algorithm);
             hashAlgorithm = hashAlgorithmForName(algorithm);
-        } catch (SignatureException e) {
-            // Should not happen, see ALLOWED_SIGNATURE_ALGORITHMS check above.
-            throw new AuthTokenParseException("Invalid signature algorithm", e);
         } catch (NoSuchAlgorithmException e) {
-            throw new AuthTokenParseException("Invalid hash algorithm", e);
-        }
-        if (signatureAlgorithm == null || signatureAlgorithm == SignatureAlgorithm.NONE) {
             // Should not happen, see ALLOWED_SIGNATURE_ALGORITHMS check above.
-            throw new AuthTokenParseException("Invalid signature algorithm");
+            throw new AuthTokenParseException("Invalid hash algorithm", e);
         }
         Objects.requireNonNull(hashAlgorithm, "hashAlgorithm");
-        signatureAlgorithm.assertValidVerificationKey(publicKey);
-        final SignatureValidator signatureValidator = DefaultSignatureValidatorFactory.INSTANCE
-            .createSignatureValidator(signatureAlgorithm, publicKey);
+
         final byte[] decodedSignature = decodeBase64(signature);
 
         final byte[] originHash = hashAlgorithm.digest(originBytes);
@@ -100,9 +96,13 @@ public void validate(String algorithm, String signature, PublicKey publicKey, St
 
         // Note that in case of ECDSA, the eID card outputs raw R||S, but JCA's SHA384withECDSA signature
         // validation implementation requires the signature in DER encoding.
-        // JJWT's EllipticCurveProvider.transcodeSignatureToDER() internally takes care of transcoding
-        // raw R||S to DER as needed inside EllipticCurveProvider.isValid().
-        if (!signatureValidator.isValid(concatSignedFields, decodedSignature)) {
+        // JJWT internally takes care of transcoding raw R||S to DER as needed.
+        final VerifySecureDigestRequest<PublicKey> verificationRequest =
+            new DefaultVerifySecureDigestRequest<>(
+                new ByteArrayInputStream(concatSignedFields),
+                null, null,
+                publicKey, decodedSignature);
+        if (!signatureAlgorithm.verify(verificationRequest)) {
             throw new AuthTokenSignatureValidationException();
         }
     }
diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java
index d39cfe51..9e4a5598 100644
--- a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java
+++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -38,7 +38,6 @@
 
 import static eu.webeid.security.util.Collections.newHashSet;
 import static eu.webeid.security.util.DateAndTime.requirePositiveDuration;
-import static eu.webeid.security.validator.ocsp.OcspUrl.AIA_ESTEID_2015;
 
 /**
  * Stores configuration parameters for {@link AuthTokenValidatorImpl}.
@@ -49,6 +48,8 @@ public final class AuthTokenValidationConfiguration {
     private Collection<X509Certificate> trustedCACertificates = new HashSet<>();
     private boolean isUserCertificateRevocationCheckWithOcspEnabled = true;
     private Duration ocspRequestTimeout = Duration.ofSeconds(5);
+    private Duration allowedOcspResponseTimeSkew = Duration.ofMinutes(15);
+    private Duration maxOcspResponseThisUpdateAge = Duration.ofMinutes(2);
     private DesignatedOcspServiceConfiguration designatedOcspServiceConfiguration;
     // Don't allow Estonian Mobile-ID policy by default.
     private Collection<ASN1ObjectIdentifier> disallowedSubjectCertificatePolicies = newHashSet(
@@ -57,8 +58,7 @@ public final class AuthTokenValidationConfiguration {
         SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY_V3,
         SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY
     );
-    // Disable OCSP nonce extension for EstEID 2015 cards by default.
-    private Collection<URI> nonceDisabledOcspUrls = newHashSet(AIA_ESTEID_2015);
+    private Collection<URI> nonceDisabledOcspUrls = new HashSet<>();
 
     AuthTokenValidationConfiguration() {
     }
@@ -68,6 +68,8 @@ private AuthTokenValidationConfiguration(AuthTokenValidationConfiguration other)
         this.trustedCACertificates = Collections.unmodifiableSet(new HashSet<>(other.trustedCACertificates));
         this.isUserCertificateRevocationCheckWithOcspEnabled = other.isUserCertificateRevocationCheckWithOcspEnabled;
         this.ocspRequestTimeout = other.ocspRequestTimeout;
+        this.allowedOcspResponseTimeSkew = other.allowedOcspResponseTimeSkew;
+        this.maxOcspResponseThisUpdateAge = other.maxOcspResponseThisUpdateAge;
         this.designatedOcspServiceConfiguration = other.designatedOcspServiceConfiguration;
         this.disallowedSubjectCertificatePolicies = Collections.unmodifiableSet(new HashSet<>(other.disallowedSubjectCertificatePolicies));
         this.nonceDisabledOcspUrls = Collections.unmodifiableSet(new HashSet<>(other.nonceDisabledOcspUrls));
@@ -101,6 +103,22 @@ void setOcspRequestTimeout(Duration ocspRequestTimeout) {
         this.ocspRequestTimeout = ocspRequestTimeout;
     }
 
+    public Duration getAllowedOcspResponseTimeSkew() {
+        return allowedOcspResponseTimeSkew;
+    }
+
+    public void setAllowedOcspResponseTimeSkew(Duration allowedOcspResponseTimeSkew) {
+        this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew;
+    }
+
+    public Duration getMaxOcspResponseThisUpdateAge() {
+        return maxOcspResponseThisUpdateAge;
+    }
+
+    public void setMaxOcspResponseThisUpdateAge(Duration maxOcspResponseThisUpdateAge) {
+        this.maxOcspResponseThisUpdateAge = maxOcspResponseThisUpdateAge;
+    }
+
     public DesignatedOcspServiceConfiguration getDesignatedOcspServiceConfiguration() {
         return designatedOcspServiceConfiguration;
     }
@@ -130,6 +148,8 @@ void validate() {
             throw new IllegalArgumentException("At least one trusted certificate authority must be provided");
         }
         requirePositiveDuration(ocspRequestTimeout, "OCSP request timeout");
+        requirePositiveDuration(allowedOcspResponseTimeSkew, "Allowed OCSP response time-skew");
+        requirePositiveDuration(maxOcspResponseThisUpdateAge, "Max OCSP response thisUpdate age");
     }
 
     AuthTokenValidationConfiguration copy() {
diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java
index 22fbcbdc..3476ea41 100644
--- a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java
+++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java
index 564f41af..ad6b692e 100644
--- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java
+++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -77,7 +77,7 @@ public AuthTokenValidatorBuilder withTrustedCertificateAuthorities(X509Certifica
         if (LOG.isDebugEnabled()) {
             LOG.debug("Trusted intermediate certificate authorities set to {}",
                 configuration.getTrustedCACertificates().stream()
-                    .map(X509Certificate::getSubjectDN)
+                    .map(X509Certificate::getSubjectX500Principal)
                     .collect(Collectors.toList()));
         }
         return this;
@@ -127,6 +127,38 @@ public AuthTokenValidatorBuilder withOcspRequestTimeout(Duration ocspRequestTime
         return this;
     }
 
+    /**
+     * Sets the allowed time skew for OCSP response's thisUpdate and nextUpdate times.
+     * This parameter is used to allow discrepancies between the system clock and the OCSP responder's clock,
+     * which may occur due to clock drift, network delays or revocation updates that are not published in real time.
+     * <p>
+     * This is an optional configuration parameter, the default is 15 minutes.
+     * The relatively long default is specifically chosen to account for one particular OCSP responder that used
+     * CRLs for authoritative revocation info, these CRLs were updated every 15 minutes.
+     *
+     * @param allowedTimeSkew the allowed time skew
+     * @return the builder instance for method chaining.
+     */
+    public AuthTokenValidatorBuilder withAllowedOcspResponseTimeSkew(Duration allowedTimeSkew) {
+        configuration.setAllowedOcspResponseTimeSkew(allowedTimeSkew);
+        LOG.debug("Allowed OCSP response time skew set to {}", allowedTimeSkew);
+        return this;
+    }
+
+    /**
+     * Sets the maximum age of the OCSP response's thisUpdate time before it is considered too old.
+     * <p>
+     * This is an optional configuration parameter, the default is 2 minutes.
+     *
+     * @param maxThisUpdateAge the maximum age of the OCSP response's thisUpdate time
+     * @return the builder instance for method chaining.
+     */
+    public AuthTokenValidatorBuilder withMaxOcspResponseThisUpdateAge(Duration maxThisUpdateAge) {
+        configuration.setMaxOcspResponseThisUpdateAge(maxThisUpdateAge);
+        LOG.debug("Maximum OCSP response thisUpdate age set to {}", maxThisUpdateAge);
+        return this;
+    }
+
     /**
      * Adds the given URLs to the list of OCSP URLs for which the nonce protocol extension will be disabled.
      * The OCSP URL is extracted from the user certificate and some OCSP services don't support the nonce extension.
diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java
index f9b58d6b..023e7996 100644
--- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java
+++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -23,13 +23,13 @@
 package eu.webeid.security.validator;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.ObjectReader;
 import eu.webeid.security.authtoken.WebEidAuthToken;
 import eu.webeid.security.certificate.CertificateLoader;
 import eu.webeid.security.certificate.CertificateValidator;
 import eu.webeid.security.exceptions.JceException;
 import eu.webeid.security.exceptions.AuthTokenParseException;
 import eu.webeid.security.exceptions.AuthTokenException;
-import eu.webeid.security.validator.certvalidators.SubjectCertificateExpiryValidator;
 import eu.webeid.security.validator.certvalidators.SubjectCertificateNotRevokedValidator;
 import eu.webeid.security.validator.certvalidators.SubjectCertificatePolicyValidator;
 import eu.webeid.security.validator.certvalidators.SubjectCertificatePurposeValidator;
@@ -57,7 +57,7 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator {
     private static final int TOKEN_MAX_LENGTH = 10000;
     private static final Logger LOG = LoggerFactory.getLogger(AuthTokenValidatorImpl.class);
 
-    private static final ObjectMapper objectMapper = new ObjectMapper();
+    private static final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class);
 
     private final AuthTokenValidationConfiguration configuration;
     private final SubjectCertificateValidatorBatch simpleSubjectCertificateValidators;
@@ -84,7 +84,6 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator {
         trustedCACertificateCertStore = CertificateValidator.buildCertStoreFromCertificates(configuration.getTrustedCACertificates());
 
         simpleSubjectCertificateValidators = SubjectCertificateValidatorBatch.createFrom(
-            new SubjectCertificateExpiryValidator(trustedCACertificateAnchors)::validateCertificateExpiry,
             SubjectCertificatePurposeValidator::validateCertificatePurpose,
             new SubjectCertificatePolicyValidator(configuration.getDisallowedSubjectCertificatePolicies())::validateCertificatePolicies
         );
@@ -109,7 +108,7 @@ public WebEidAuthToken parse(String authToken) throws AuthTokenException {
             validateTokenLength(authToken);
             return parseToken(authToken);
         } catch (Exception e) {
-            // Generally "log and rethrow" is an anti-pattern, but it fits with the surrounding logging style.
+            // Generally "log and rethrow" is an antipattern, but it fits with the surrounding logging style.
             LOG.warn("Token parsing was interrupted:", e);
             throw e;
         }
@@ -121,7 +120,7 @@ public X509Certificate validate(WebEidAuthToken authToken, String currentChallen
             LOG.info("Starting token validation");
             return validateToken(authToken, currentChallengeNonce);
         } catch (Exception e) {
-            // Generally "log and rethrow" is an anti-pattern, but it fits with the surrounding logging style.
+            // Generally "log and rethrow" is an antipattern, but it fits with the surrounding logging style.
             LOG.warn("Token validation was interrupted:", e);
             throw e;
         }
@@ -138,7 +137,7 @@ private void validateTokenLength(String authToken) throws AuthTokenParseExceptio
 
     private WebEidAuthToken parseToken(String authToken) throws AuthTokenParseException {
         try {
-            final WebEidAuthToken token = objectMapper.readValue(authToken, WebEidAuthToken.class);
+            final WebEidAuthToken token = OBJECT_READER.readValue(authToken);
             if (token == null) {
                 throw new AuthTokenParseException("Web eID authentication token is null");
             }
@@ -185,7 +184,11 @@ private SubjectCertificateValidatorBatch getCertTrustValidators() {
         return SubjectCertificateValidatorBatch.createFrom(
             certTrustedValidator::validateCertificateTrusted
         ).addOptional(configuration.isUserCertificateRevocationCheckWithOcspEnabled(),
-            new SubjectCertificateNotRevokedValidator(certTrustedValidator, ocspClient, ocspServiceProvider)::validateCertificateNotRevoked
+            new SubjectCertificateNotRevokedValidator(certTrustedValidator,
+                ocspClient, ocspServiceProvider,
+                configuration.getAllowedOcspResponseTimeSkew(),
+                configuration.getMaxOcspResponseThisUpdateAge()
+            )::validateCertificateNotRevoked
         );
     }
 
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateExpiryValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateExpiryValidator.java
deleted file mode 100644
index 90e35076..00000000
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateExpiryValidator.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (c) 2020-2023 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-package eu.webeid.security.validator.certvalidators;
-
-import eu.webeid.security.certificate.CertificateValidator;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import eu.webeid.security.exceptions.AuthTokenException;
-import eu.webeid.security.util.DateAndTime;
-
-import java.security.cert.TrustAnchor;
-import java.security.cert.X509Certificate;
-import java.util.Date;
-import java.util.Set;
-
-public final class SubjectCertificateExpiryValidator {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateExpiryValidator.class);
-
-    private final Set<TrustAnchor> trustedCACertificateAnchors;
-
-    public SubjectCertificateExpiryValidator(Set<TrustAnchor> trustedCACertificateAnchors) {
-        this.trustedCACertificateAnchors = trustedCACertificateAnchors;
-    }
-
-    /**
-     * Checks the validity of the user certificate from the authentication token
-     * and the validity of trusted CA certificates.
-     *
-     * @param subjectCertificate user certificate to be validated
-     * @throws AuthTokenException when a CA certificate or the user certificate is expired or not yet valid
-     */
-    public void validateCertificateExpiry(X509Certificate subjectCertificate) throws AuthTokenException {
-        // Use the clock instance so that the date can be mocked in tests.
-        final Date now = DateAndTime.DefaultClock.INSTANCE.now();
-        CertificateValidator.trustedCACertificatesAreValidOnDate(trustedCACertificateAnchors, now);
-        LOG.debug("CA certificates are valid.");
-        CertificateValidator.certificateIsValidOnDate(subjectCertificate, now, "User");
-        LOG.debug("User certificate is valid.");
-    }
-
-}
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java
index bb38e486..c460d405 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,7 +24,12 @@
 
 import eu.webeid.security.exceptions.AuthTokenException;
 import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
-import eu.webeid.security.validator.ocsp.*;
+import eu.webeid.security.util.DateAndTime;
+import eu.webeid.security.validator.ocsp.DigestCalculatorImpl;
+import eu.webeid.security.validator.ocsp.OcspClient;
+import eu.webeid.security.validator.ocsp.OcspRequestBuilder;
+import eu.webeid.security.validator.ocsp.OcspResponseValidator;
+import eu.webeid.security.validator.ocsp.OcspServiceProvider;
 import eu.webeid.security.validator.ocsp.service.OcspService;
 import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
 import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
@@ -41,10 +46,6 @@
 import org.bouncycastle.operator.OperatorCreationException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import eu.webeid.security.validator.ocsp.Digester;
-import eu.webeid.security.validator.ocsp.OcspClient;
-import eu.webeid.security.validator.ocsp.OcspRequestBuilder;
-import eu.webeid.security.validator.ocsp.OcspServiceProvider;
 
 import java.io.IOException;
 import java.math.BigInteger;
@@ -52,17 +53,19 @@
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
+import java.time.Duration;
 import java.util.Date;
 import java.util.Objects;
 
 public final class SubjectCertificateNotRevokedValidator {
 
     private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateNotRevokedValidator.class);
-    private static final DigestCalculator DIGEST_CALCULATOR = Digester.sha1();
 
     private final SubjectCertificateTrustedValidator trustValidator;
     private final OcspClient ocspClient;
     private final OcspServiceProvider ocspServiceProvider;
+    private final Duration allowedOcspResponseTimeSkew;
+    private final Duration maxOcspResponseThisUpdateAge;
 
     static {
         Security.addProvider(new BouncyCastleProvider());
@@ -70,10 +73,14 @@ public final class SubjectCertificateNotRevokedValidator {
 
     public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator trustValidator,
                                                  OcspClient ocspClient,
-                                                 OcspServiceProvider ocspServiceProvider) {
+                                                 OcspServiceProvider ocspServiceProvider,
+                                                 Duration allowedOcspResponseTimeSkew,
+                                                 Duration maxOcspResponseThisUpdateAge) {
         this.trustValidator = trustValidator;
         this.ocspClient = ocspClient;
         this.ocspServiceProvider = ocspServiceProvider;
+        this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew;
+        this.maxOcspResponseThisUpdateAge = maxOcspResponseThisUpdateAge;
     }
 
     /**
@@ -86,10 +93,6 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
         try {
             OcspService ocspService = ocspServiceProvider.getService(subjectCertificate);
 
-            if (!ocspService.doesSupportNonce()) {
-                LOG.debug("Disabling OCSP nonce extension");
-            }
-
             final CertificateID certificateId = getCertificateId(subjectCertificate,
                 Objects.requireNonNull(trustValidator.getSubjectCertificateIssuerCertificate()));
 
@@ -98,6 +101,10 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
                 .enableOcspNonce(ocspService.doesSupportNonce())
                 .build();
 
+            if (!ocspService.doesSupportNonce()) {
+                LOG.debug("Disabling OCSP nonce extension");
+            }
+
             LOG.debug("Sending OCSP request");
             final OCSPResp response = Objects.requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request));
             if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) {
@@ -156,8 +163,9 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer
         //   4. The signer is currently authorized to provide a response for the
         //      certificate in question.
 
-        final Date producedAt = basicResponse.getProducedAt();
-        ocspService.validateResponderCertificate(responderCert, producedAt);
+        // Use the clock instance so that the date can be mocked in tests.
+        final Date now = DateAndTime.DefaultClock.getInstance().now();
+        ocspService.validateResponderCertificate(responderCert, now);
 
         //   5. The time at which the status being indicated is known to be
         //      correct (thisUpdate) is sufficiently recent.
@@ -166,7 +174,7 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer
         //      be available about the status of the certificate (nextUpdate) is
         //      greater than the current time.
 
-        OcspResponseValidator.validateCertificateStatusUpdateTime(certStatusResponse, producedAt);
+        OcspResponseValidator.validateCertificateStatusUpdateTime(certStatusResponse, allowedOcspResponseTimeSkew, maxOcspResponseThisUpdateAge);
 
         // Now we can accept the signed response as valid and validate the certificate status.
         OcspResponseValidator.validateSubjectCertificateStatus(certStatusResponse);
@@ -188,7 +196,8 @@ private static void checkNonce(OCSPReq request, BasicOCSPResp response) throws U
 
     private static CertificateID getCertificateId(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws CertificateEncodingException, IOException, OCSPException {
         final BigInteger serial = subjectCertificate.getSerialNumber();
-        return new CertificateID(DIGEST_CALCULATOR,
+        final DigestCalculator digestCalculator = DigestCalculatorImpl.sha1();
+        return new CertificateID(digestCalculator,
             new X509CertificateHolder(issuerCertificate.getEncoded()), serial);
     }
 
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java
index e6b84869..8f584c7e 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java
index 1e220da8..279772f3 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java
index 0471d5a6..a706ffc4 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,10 +24,12 @@
 
 import eu.webeid.security.certificate.CertificateValidator;
 import eu.webeid.security.exceptions.AuthTokenException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import eu.webeid.security.exceptions.CertificateExpiredException;
 import eu.webeid.security.exceptions.CertificateNotTrustedException;
+import eu.webeid.security.exceptions.CertificateNotYetValidException;
 import eu.webeid.security.util.DateAndTime;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.security.cert.CertStore;
 import java.security.cert.TrustAnchor;
@@ -49,21 +51,25 @@ public SubjectCertificateTrustedValidator(Set<TrustAnchor> trustedCACertificateA
     }
 
     /**
-     * Validates that the user certificate from the authentication token is signed by a trusted certificate authority.
+     * Checks that the user certificate from the authentication token is valid and signed by
+     * a trusted certificate authority. Also checks the validity of the user certificate's
+     * trusted CA certificate.
      *
      * @param subjectCertificate user certificate to be validated
-     * @throws CertificateNotTrustedException when user certificate is not signed by a trusted CA.
+     * @throws CertificateNotTrustedException when user certificate is not signed by a trusted CA
+     * @throws CertificateNotYetValidException when a CA certificate in the chain or the user certificate is not yet valid
+     * @throws CertificateExpiredException when a CA certificate in the chain or the user certificate is expired
      */
     public void validateCertificateTrusted(X509Certificate subjectCertificate) throws AuthTokenException {
         // Use the clock instance so that the date can be mocked in tests.
-        final Date now = DateAndTime.DefaultClock.INSTANCE.now();
+        final Date now = DateAndTime.DefaultClock.getInstance().now();
         subjectCertificateIssuerCertificate = CertificateValidator.validateIsSignedByTrustedCA(
             subjectCertificate,
             trustedCACertificateAnchors,
             trustedCACertificateCertStore,
             now
         );
-        LOG.debug("Subject certificate is signed by a trusted CA");
+        LOG.debug("Subject certificate is valid and signed by a trusted CA");
     }
 
     public X509Certificate getSubjectCertificateIssuerCertificate() {
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java
index ee1b579c..08eccdf8 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java
index dd893c94..264135e0 100644
--- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java
+++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/Digester.java b/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java
similarity index 56%
rename from src/main/java/eu/webeid/security/validator/ocsp/Digester.java
rename to src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java
index 6260c296..35f9fcb7 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/Digester.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -20,26 +20,9 @@
  * SOFTWARE.
  */
 
-/*
- * Copyright 2017 The Netty Project
- * Copyright 2020 The Web eID project
- *
- * The Netty Project and The Web eID Project license this file to you under the
- * Apache License, version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the License at:
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
 package eu.webeid.security.validator.ocsp;
 
-import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
 import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.crypto.Digest;
@@ -52,33 +35,26 @@
 
 /**
  * BouncyCastle's OCSPReqBuilder needs a DigestCalculator but BC doesn't
- * provide any public implementations of that interface. That's why we need to
- * write our own. There's a default SHA-1 implementation and one for SHA-256.
- * Which one to use will depend on the Certificate Authority (CA).
+ * provide any public implementations of it, hence this implementation.
  */
-public final class Digester implements DigestCalculator {
+public final class DigestCalculatorImpl implements DigestCalculator {
+
+    private static final AlgorithmIdentifier SHA1 = new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1);
+    private static final AlgorithmIdentifier SHA256 = new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256);
 
     private final DigestOutputStream dos;
     private final AlgorithmIdentifier algId;
 
-    public static DigestCalculator sha1() {
-        final Digest digest = new SHA1Digest();
-        final AlgorithmIdentifier algId = new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1);
 
-        return new Digester(digest, algId);
+    public static DigestCalculator sha1() {
+        return new DigestCalculatorImpl(new SHA1Digest(), SHA1);
     }
 
     public static DigestCalculator sha256() {
-        Digest digest = new SHA256Digest();
-
-        // The OID for SHA-256: http://www.oid-info.com/get/2.16.840.1.101.3.4.2.1
-        final ASN1ObjectIdentifier oid = new ASN1ObjectIdentifier("2.16.840.1.101.3.4.2.1").intern();
-        final AlgorithmIdentifier algId = new AlgorithmIdentifier(oid);
-
-        return new Digester(digest, algId);
+        return new DigestCalculatorImpl(new SHA256Digest(), SHA256);
     }
 
-    private Digester(Digest digest, AlgorithmIdentifier algId) {
+    private DigestCalculatorImpl(Digest digest, AlgorithmIdentifier algId) {
         this.dos = new DigestOutputStream(digest);
         this.algId = algId;
     }
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java
index 1e275b0f..7f2e9477 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java
index 230bf454..27ad87f1 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -20,23 +20,6 @@
  * SOFTWARE.
  */
 
-/*
- * Copyright 2017 The Netty Project
- * Copyright (c) 2020-2023 Estonian Information System Authority
- *
- * The Netty Project and The Web eID Project license this file to you under the
- * Apache License, version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the License at:
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
 package eu.webeid.security.validator.ocsp;
 
 import org.bouncycastle.asn1.DEROctetString;
@@ -48,17 +31,17 @@
 import org.bouncycastle.cert.ocsp.OCSPReq;
 import org.bouncycastle.cert.ocsp.OCSPReqBuilder;
 
+import java.io.IOException;
 import java.security.SecureRandom;
 import java.util.Objects;
 
 /**
- * This is a simplified version of Bouncy Castle's {@link OCSPReqBuilder}.
- *
- * @see OCSPReqBuilder
+ * This is a wrapper around Bouncy Castle's {@link OCSPReqBuilder} that
+ * adds the OCSP nonce extension to the request if needed.
  */
 public final class OcspRequestBuilder {
 
-    private static final SecureRandom GENERATOR = new SecureRandom();
+    private static final SecureRandom RANDOM_GENERATOR = new SecureRandom();
 
     private boolean ocspNonceEnabled = true;
     private CertificateID certificateId;
@@ -82,19 +65,24 @@ public OCSPReq build() throws OCSPException {
         builder.addRequest(Objects.requireNonNull(certificateId, "certificateId"));
 
         if (ocspNonceEnabled) {
-            addNonce(builder);
+            try {
+                addNonce(builder);
+            } catch (IOException e) {
+                throw new OCSPException("Failed to generate OCSP nonce extension", e);
+            }
         }
 
         return builder.build();
     }
 
-    private void addNonce(OCSPReqBuilder builder) {
-        final byte[] nonce = new byte[8];
-        GENERATOR.nextBytes(nonce);
+    private void addNonce(OCSPReqBuilder builder) throws IOException {
+        final byte[] nonce = new byte[32];
+        RANDOM_GENERATOR.nextBytes(nonce);
 
         final Extension[] extensions = new Extension[]{
             new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
-                new DEROctetString(nonce))
+                // Follow OpenSSL OCSP nonce encoding convention and add double octet string header.
+                new DEROctetString(new DEROctetString(nonce)))
         };
         builder.setRequestExtensions(new Extensions(extensions));
     }
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java
index bbdb180b..0dc4fda5 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -25,6 +25,7 @@
 import eu.webeid.security.exceptions.OCSPCertificateException;
 import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
 import eu.webeid.security.exceptions.UserCertificateRevokedException;
+import eu.webeid.security.util.DateAndTime;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.ocsp.BasicOCSPResp;
 import org.bouncycastle.cert.ocsp.CertificateStatus;
@@ -39,11 +40,9 @@
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateParsingException;
 import java.security.cert.X509Certificate;
-import java.text.SimpleDateFormat;
-import java.util.Date;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Objects;
-import java.util.TimeZone;
-import java.util.concurrent.TimeUnit;
 
 public final class OcspResponseValidator {
 
@@ -53,14 +52,13 @@ public final class OcspResponseValidator {
      * https://oidref.com/1.3.6.1.5.5.7.3.9
      */
     private static final String OID_OCSP_SIGNING = "1.3.6.1.5.5.7.3.9";
-
-    private static final long ALLOWED_TIME_SKEW = TimeUnit.MINUTES.toMillis(15);
+    private static final String ERROR_PREFIX = "Certificate status update time check failed: ";
 
     public static void validateHasSigningExtension(X509Certificate certificate) throws OCSPCertificateException {
         Objects.requireNonNull(certificate, "certificate");
         try {
             if (certificate.getExtendedKeyUsage() == null || !certificate.getExtendedKeyUsage().contains(OID_OCSP_SIGNING)) {
-                throw new OCSPCertificateException("Certificate " + certificate.getSubjectDN() +
+                throw new OCSPCertificateException("Certificate " + certificate.getSubjectX500Principal() +
                     " does not contain the key usage extension for OCSP response signing");
             }
         } catch (CertificateParsingException e) {
@@ -77,7 +75,7 @@ public static void validateResponseSignature(BasicOCSPResp basicResponse, X509Ce
         }
     }
 
-    public static void validateCertificateStatusUpdateTime(SingleResp certStatusResponse, Date producedAt) throws UserCertificateOCSPCheckFailedException {
+    public static void validateCertificateStatusUpdateTime(SingleResp certStatusResponse, Duration allowedTimeSkew, Duration maxThisupdateAge) throws UserCertificateOCSPCheckFailedException {
         // From RFC 2560, https://www.ietf.org/rfc/rfc2560.txt:
         // 4.2.2.  Notes on OCSP Responses
         // 4.2.2.1.  Time
@@ -87,17 +85,34 @@ public static void validateCertificateStatusUpdateTime(SingleResp certStatusResp
         //   SHOULD be considered unreliable.
         //   If nextUpdate is not set, the responder is indicating that newer
         //   revocation information is available all the time.
-        final Date notAllowedBefore = new Date(producedAt.getTime() - ALLOWED_TIME_SKEW);
-        final Date notAllowedAfter = new Date(producedAt.getTime() + ALLOWED_TIME_SKEW);
-        final Date thisUpdate = certStatusResponse.getThisUpdate();
-        final Date nextUpdate = certStatusResponse.getNextUpdate() != null ? certStatusResponse.getNextUpdate() : thisUpdate;
-        if (notAllowedAfter.before(thisUpdate) ||
-            notAllowedBefore.after(nextUpdate)) {
-            throw new UserCertificateOCSPCheckFailedException("Certificate status update time check failed: " +
-                "notAllowedBefore: " + toUtcString(notAllowedBefore) +
-                ", notAllowedAfter: " + toUtcString(notAllowedAfter) +
-                ", thisUpdate: " + toUtcString(thisUpdate) +
-                ", nextUpdate: " + toUtcString(certStatusResponse.getNextUpdate()));
+        final Instant now = DateAndTime.DefaultClock.getInstance().now().toInstant();
+        final Instant earliestAcceptableTimeSkew = now.minus(allowedTimeSkew);
+        final Instant latestAcceptableTimeSkew = now.plus(allowedTimeSkew);
+        final Instant minimumValidThisUpdateTime = now.minus(maxThisupdateAge);
+
+        final Instant thisUpdate = certStatusResponse.getThisUpdate().toInstant();
+        if (thisUpdate.isAfter(latestAcceptableTimeSkew)) {
+            throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX +
+                "thisUpdate '" + thisUpdate + "' is too far in the future, " +
+                "latest allowed: '" + latestAcceptableTimeSkew + "'");
+        }
+        if (thisUpdate.isBefore(minimumValidThisUpdateTime)) {
+            throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX +
+                "thisUpdate '" + thisUpdate + "' is too old, " +
+                "minimum time allowed: '" + minimumValidThisUpdateTime + "'");
+        }
+
+        if (certStatusResponse.getNextUpdate() == null) {
+            return;
+        }
+        final Instant nextUpdate = certStatusResponse.getNextUpdate().toInstant();
+        if (nextUpdate.isBefore(earliestAcceptableTimeSkew)) {
+            throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX +
+                "nextUpdate '" + nextUpdate + "' is in the past");
+        }
+        if (nextUpdate.isBefore(thisUpdate)) {
+            throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX +
+                "nextUpdate '" + nextUpdate + "' is before thisUpdate '" + thisUpdate + "'");
         }
     }
 
@@ -118,15 +133,6 @@ public static void validateSubjectCertificateStatus(SingleResp certStatusRespons
         }
     }
 
-    private static String toUtcString(Date date) {
-        if (date == null) {
-            return String.valueOf((Object) null);
-        }
-        final SimpleDateFormat dateFormatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss z");
-        dateFormatter.setTimeZone(TimeZone.getTimeZone("UTC"));
-        return dateFormatter.format(date);
-    }
-
     private OcspResponseValidator() {
         throw new IllegalStateException("Utility class");
     }
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java
index c80129d7..5f83c1d9 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java
index fbff637e..96894080 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -37,8 +37,6 @@
 
 public final class OcspUrl {
 
-    public static final URI AIA_ESTEID_2015 = URI.create("http://aia.sk.ee/esteid2015");
-
     /**
      * Returns the OCSP responder {@link URI} or an empty {@code Optional} if it doesn't have one.
      */
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OkHttpOcspClient.java b/src/main/java/eu/webeid/security/validator/ocsp/OkHttpOcspClient.java
index d4a329cc..7557e08b 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/OkHttpOcspClient.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/OkHttpOcspClient.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java
index 465e9ff3..e04823c3 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -71,13 +71,13 @@ public URI getAccessLocation() {
     }
 
     @Override
-    public void validateResponderCertificate(X509CertificateHolder cert, Date producedAt) throws AuthTokenException {
+    public void validateResponderCertificate(X509CertificateHolder cert, Date now) throws AuthTokenException {
         try {
             final X509Certificate certificate = certificateConverter.getCertificate(cert);
-            CertificateValidator.certificateIsValidOnDate(certificate, producedAt, "AIA OCSP responder");
+            CertificateValidator.certificateIsValidOnDate(certificate, now, "AIA OCSP responder");
             // Trusted certificates' validity has been already verified in validateCertificateExpiry().
             OcspResponseValidator.validateHasSigningExtension(certificate);
-            CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, producedAt);
+            CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, now);
         } catch (CertificateException e) {
             throw new OCSPCertificateException("Invalid responder certificate", e);
         }
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java
index 9d9326bf..8781e3a5 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java
index 499d3289..bafba269 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -59,7 +59,7 @@ public URI getAccessLocation() {
     }
 
     @Override
-    public void validateResponderCertificate(X509CertificateHolder cert, Date producedAt) throws AuthTokenException {
+    public void validateResponderCertificate(X509CertificateHolder cert, Date now) throws AuthTokenException {
         try {
             final X509Certificate responderCertificate = certificateConverter.getCertificate(cert);
             // Certificate pinning is implemented simply by comparing the certificates or their public keys,
@@ -68,7 +68,7 @@ public void validateResponderCertificate(X509CertificateHolder cert, Date produc
                 throw new OCSPCertificateException("Responder certificate from the OCSP response is not equal to " +
                     "the configured designated OCSP responder certificate");
             }
-            certificateIsValidOnDate(responderCertificate, producedAt, "Designated OCSP responder");
+            certificateIsValidOnDate(responderCertificate, now, "Designated OCSP responder");
         } catch (CertificateException e) {
             throw new OCSPCertificateException("X509CertificateHolder conversion to X509Certificate failed", e);
         }
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java
index 5eff17ae..0bc03193 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java
index 347e83cd..97bbdf2c 100644
--- a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java
+++ b/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -34,6 +34,6 @@ public interface OcspService {
 
     URI getAccessLocation();
 
-    void validateResponderCertificate(X509CertificateHolder cert, Date date) throws AuthTokenException;
+    void validateResponderCertificate(X509CertificateHolder cert, Date now) throws AuthTokenException;
 
 }
diff --git a/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java b/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java
index 8375fb21..42313d03 100644
--- a/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java
+++ b/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java
@@ -2,12 +2,10 @@
 
 import org.junit.jupiter.api.Test;
 
-import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 
 import static eu.webeid.security.testutil.Certificates.getOrganizationCert;
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 class CertificateDataTest {
 
@@ -15,24 +13,22 @@ class CertificateDataTest {
     void whenOrganizationCertificate_thenSubjectCNAndIdCodeAndCountryCodeExtractionSucceeds() throws Exception {
         final X509Certificate organizationCert = getOrganizationCert();
 
-        assertThat(CertificateData.getSubjectCN(organizationCert))
+        assertThat(CertificateData.getSubjectCN(organizationCert).get())
             .isEqualTo("Testijad.ee isikutuvastus");
-        assertThat(CertificateData.getSubjectIdCode(organizationCert))
+        assertThat(CertificateData.getSubjectIdCode(organizationCert).get())
             .isEqualTo("12276279");
-        assertThat(CertificateData.getSubjectCountryCode(organizationCert))
+        assertThat(CertificateData.getSubjectCountryCode(organizationCert).get())
             .isEqualTo("EE");
     }
 
     @Test
-    void whenOrganizationCertificate_thenSubjectGivenNameAndSurnameExtractionFails() throws Exception {
+    void whenOrganizationCertificate_thenSubjectGivenNameAndSurnameAreEmpty() throws Exception {
         final X509Certificate organizationCert = getOrganizationCert();
 
-        assertThatThrownBy(() -> CertificateData.getSubjectGivenName(organizationCert))
-            .isInstanceOf(CertificateEncodingException.class)
-            .hasMessage("X500 name RDNs empty or first element is null");
-        assertThatThrownBy(() -> CertificateData.getSubjectSurname(organizationCert))
-            .isInstanceOf(CertificateEncodingException.class)
-            .hasMessage("X500 name RDNs empty or first element is null");
+        assertThat(CertificateData.getSubjectGivenName(organizationCert))
+            .isEmpty();
+        assertThat(CertificateData.getSubjectSurname(organizationCert))
+            .isEmpty();
     }
 
 }
diff --git a/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java b/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java
index 1610c433..5790e0d2 100644
--- a/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java
+++ b/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java b/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java
index 4e06bd74..c6c2d1d3 100644
--- a/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java
+++ b/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java b/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java
index 742f2184..fd8896c3 100644
--- a/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java
+++ b/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -34,11 +34,15 @@
 
 public abstract class AbstractTestWithValidator {
 
+    /* 
+     * notBefore Time UTCTime 2021-07-22 12:43:08 UTC
+     *  notAfter Time UTCTime 2026-07-09 21:59:59 UTC
+     */
     public static final String VALID_AUTH_TOKEN = "{\"algorithm\":\"ES384\"," +
-        "\"unverifiedCertificate\":\"MIIEAzCCA2WgAwIBAgIQHWbVWxCkcYxbzz9nBzGrDzAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTE4MTAyMzE1MzM1OVoXDTIzMTAyMjIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ/u+9IncarVpgrACN6aRgUiT9lWC9H7llnxoEXe8xoCI982Md8YuJsVfRdeG5jwVfXe0N6KkHLFRARspst8qnACULkqFNat/Kj+XRwJ2UANeJ3Gl5XBr+tnLNuDf/UiR6jggHDMIIBvzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5EhAQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFOTddHnA9rJtbLwhBNyn0xZTQGCMMGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezBzBggrBgEFBQcBAQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MDUGCCsGAQUFBzAChilodHRwOi8vYy5zay5lZS9UZXN0X29mX0VTVEVJRDIwMTguZGVyLmNydDAKBggqhkjOPQQDBAOBiwAwgYcCQgHYElkX4vn821JR41akI/lpexCnJFUf4GiOMbTfzAxpZma333R8LNrmI4zbzDp03hvMTzH49g1jcbGnaCcbboS8DAJBObenUp++L5VqldHwKAps61nM4V+TiLqD0jILnTzl+pV+LexNL3uGzUfvvDNLHnF9t6ygi8+Bsjsu3iHHyM1haKM=\"," +
-        "\"appVersion\":\"https://web-eid.eu/web-eid-app/releases/2.0.0+0\"," +
-        "\"signature\":\"tbMTrZD4CKUj6atjNCHZruIeyPFAEJk2htziQ1t08BSTyA5wKKqmNmzsJ7562hWQ6+tJd6nlidHGE5jVVJRKmPtNv3f9gbT2b7RXcD4t5Pjn8eUCBCA4IX99Af32Z5ln\"," +
-        "\"format\":\"web-eid:1\"}";
+        "\"unverifiedCertificate\":\"MIIEBDCCA2WgAwIBAgIQY5OGshxoPMFg+Wfc0gFEaTAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTIxMDcyMjEyNDMwOFoXDTI2MDcwOTIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQmwEKsJTjaMHSaZj19hb9EJaJlwbKc5VFzmlGMFSJVk4dDy+eUxa5KOA7tWXqzcmhh5SYdv+MxcaQKlKWLMa36pfgv20FpEDb03GCtLqjLTRZ7649PugAQ5EmAqIic29CjggHDMIIBvzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5EhAQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFPlp/ceABC52itoqppEmbf71TJz6MGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezBzBggrBgEFBQcBAQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MDUGCCsGAQUFBzAChilodHRwOi8vYy5zay5lZS9UZXN0X29mX0VTVEVJRDIwMTguZGVyLmNydDAKBggqhkjOPQQDBAOBjAAwgYgCQgDCAgybz0u3W+tGI+AX+PiI5CrE9ptEHO5eezR1Jo4j7iGaO0i39xTGUB+NSC7P6AQbyE/ywqJjA1a62jTLcS9GHAJCARxN4NO4eVdWU3zVohCXm8WN3DWA7XUcn9TZiLGQ29P4xfQZOXJi/z4PNRRsR4plvSNB3dfyBvZn31HhC7my8woi\"," +
+        "\"appVersion\":\"https://web-eid.eu/web-eid-app/releases/2.5.0+0\"," +
+        "\"signature\":\"0Ov7ME6pTY1K2GXMj8Wxov/o2fGIMEds8OMY5dKdkB0nrqQX7fG1E5mnsbvyHpMDecMUH6Yg+p1HXdgB/lLqOcFZjt/OVXPjAAApC5d1YgRYATDcxsR1zqQwiNcHdmWn\"," +
+        "\"format\":\"web-eid:1.0\"}";
     public static final String VALID_CHALLENGE_NONCE = "12345678123456781234567812345678912356789123";
 
     protected AuthTokenValidator validator;
diff --git a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java
index 1f88eeb3..ec977e71 100644
--- a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java
+++ b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -82,6 +82,11 @@ public static AuthTokenValidator getAuthTokenValidatorWithWrongTrustedCA() throw
             CertificateLoader.loadCertificatesFromResources("ESTEID2018.cer"));
     }
 
+    public static AuthTokenValidator getAuthTokenValidatorWithJuly2024ExpiredUnrelatedTrustedCA() throws CertificateException, JceException, IOException {
+        return getAuthTokenValidator(TOKEN_ORIGIN_URL,
+            CertificateLoader.loadCertificatesFromResources("TEST_of_ESTEID2018.cer", "TEST_of_SK_OCSP_RESPONDER_2020.cer"));
+    }
+
     public static AuthTokenValidator getAuthTokenValidatorWithDisallowedESTEIDPolicy() throws CertificateException, JceException, IOException {
         return getAuthTokenValidatorBuilder(TOKEN_ORIGIN_URL, getCACertificates())
             .withDisallowedCertificatePolicies(EST_IDEMIA_POLICY)
@@ -89,6 +94,24 @@ public static AuthTokenValidator getAuthTokenValidatorWithDisallowedESTEIDPolicy
             .build();
     }
 
+    public static AuthTokenValidator getAuthTokenValidatorForBelgianIdCard() throws CertificateException, IOException, JceException {
+      return getAuthTokenValidator(
+                "https://47f0-46-131-86-189.ngrok-free.app",
+                CertificateLoader.loadCertificatesFromResources("eID TEST EC Citizen CA.cer")
+            );
+    }
+
+    public static AuthTokenValidator getAuthTokenValidatorForFinnishIdCard() throws CertificateException, IOException, JceException {
+      return getAuthTokenValidator(
+                "https://47f0-46-131-86-189.ngrok-free.app",
+                CertificateLoader.loadCertificatesFromResources("DVV TEST Certificates - G5E.crt", "VRK TEST CA for Test Purposes - G4.crt")
+            );
+    }
+
+    public static AuthTokenValidatorBuilder getDefaultAuthTokenValidatorBuilder() throws CertificateException, IOException {
+        return getAuthTokenValidatorBuilder(TOKEN_ORIGIN_URL, getCACertificates());
+    }
+
     private static AuthTokenValidatorBuilder getAuthTokenValidatorBuilder(String uri, X509Certificate[] certificates) {
         return new AuthTokenValidatorBuilder()
             .withSiteOrigin(URI.create(uri))
diff --git a/src/test/java/eu/webeid/security/testutil/Certificates.java b/src/test/java/eu/webeid/security/testutil/Certificates.java
index 8911ed6c..215773b6 100644
--- a/src/test/java/eu/webeid/security/testutil/Certificates.java
+++ b/src/test/java/eu/webeid/security/testutil/Certificates.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/testutil/Dates.java b/src/test/java/eu/webeid/security/testutil/DateMocker.java
similarity index 50%
rename from src/test/java/eu/webeid/security/testutil/Dates.java
rename to src/test/java/eu/webeid/security/testutil/DateMocker.java
index d6179c1c..ec49a049 100644
--- a/src/test/java/eu/webeid/security/testutil/Dates.java
+++ b/src/test/java/eu/webeid/security/testutil/DateMocker.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -23,42 +23,23 @@
 package eu.webeid.security.testutil;
 
 import com.fasterxml.jackson.databind.util.StdDateFormat;
-import io.jsonwebtoken.Clock;
 import eu.webeid.security.util.DateAndTime;
+import io.jsonwebtoken.Clock;
+import org.mockito.MockedStatic;
 
-import java.lang.reflect.Field;
-import java.lang.reflect.Modifier;
 import java.text.ParseException;
 import java.util.Date;
 
-public final class Dates {
-    private static final StdDateFormat STD_DATE_FORMAT = new StdDateFormat();
-
-    public static Date create(String iso8601Date) throws ParseException {
-        return STD_DATE_FORMAT.parse(iso8601Date);
-    }
-
-    public static void setMockedCertificateValidatorDate(Date mockedDate) throws NoSuchFieldException, IllegalAccessException {
-        setClockField(DateAndTime.DefaultClock.class, mockedDate);
-    }
-
-    public static void resetMockedCertificateValidatorDate() throws NoSuchFieldException, IllegalAccessException {
-        setClockField(DateAndTime.DefaultClock.class, new Date());
-    }
-
-    private static void setClockField(Class<? extends Clock> cls, Date date) throws NoSuchFieldException, IllegalAccessException {
-        final Field clockField = cls.getDeclaredField("INSTANCE");
-        setFinalStaticField(clockField, (Clock) () -> date);
-    }
+public class DateMocker {
 
-    private static void setFinalStaticField(Field field, Object newValue) throws NoSuchFieldException, IllegalAccessException {
-        field.setAccessible(true);
-
-        final Field modifiersField = Field.class.getDeclaredField("modifiers");
-        modifiersField.setAccessible(true);
-        modifiersField.setInt(field, field.getModifiers() & ~Modifier.FINAL);
+    private static final StdDateFormat STD_DATE_FORMAT = new StdDateFormat();
 
-        field.set(null, newValue);
+    public static void mockDate(String iso8601Date, MockedStatic<DateAndTime.DefaultClock> mockedClock) {
+        try {
+            final Date theDate = STD_DATE_FORMAT.parse(iso8601Date);
+            mockedClock.when(DateAndTime.DefaultClock::getInstance).thenReturn((Clock) () -> theDate);
+        } catch (ParseException e) {
+            throw new RuntimeException(e);
+        }
     }
-
 }
diff --git a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java b/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java
index d0ececa3..8f559c4b 100644
--- a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java
+++ b/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -25,10 +25,9 @@
 import eu.webeid.security.certificate.CertificateValidator;
 import eu.webeid.security.exceptions.JceException;
 import eu.webeid.security.exceptions.OCSPCertificateException;
+import eu.webeid.security.validator.ocsp.OcspServiceProvider;
 import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration;
 import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration;
-import org.jetbrains.annotations.NotNull;
-import eu.webeid.security.validator.ocsp.OcspServiceProvider;
 
 import java.io.IOException;
 import java.net.URI;
@@ -37,9 +36,10 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static eu.webeid.security.testutil.Certificates.*;
+import static eu.webeid.security.testutil.Certificates.getTestEsteid2015CA;
+import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA;
+import static eu.webeid.security.testutil.Certificates.getTestSkOcspResponder2020;
 import static eu.webeid.security.util.Collections.newHashSet;
-import static eu.webeid.security.validator.ocsp.OcspUrl.AIA_ESTEID_2015;
 
 public class OcspServiceMaker {
 
@@ -55,29 +55,25 @@ public class OcspServiceMaker {
         }
     }
 
-    @NotNull
     public static OcspServiceProvider getAiaOcspServiceProvider() throws JceException {
         return new OcspServiceProvider(null, getAiaOcspServiceConfiguration());
     }
 
-    @NotNull
     public static OcspServiceProvider getDesignatedOcspServiceProvider() throws CertificateException, IOException, OCSPCertificateException, JceException {
         return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(), getAiaOcspServiceConfiguration());
     }
 
-    @NotNull
     public static OcspServiceProvider getDesignatedOcspServiceProvider(boolean doesSupportNonce) throws CertificateException, IOException, JceException, OCSPCertificateException {
         return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(doesSupportNonce), getAiaOcspServiceConfiguration());
     }
 
-    @NotNull
     public static OcspServiceProvider getDesignatedOcspServiceProvider(String ocspServiceAccessLocation) throws CertificateException, IOException, OCSPCertificateException, JceException {
         return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(true, ocspServiceAccessLocation), getAiaOcspServiceConfiguration());
     }
 
     private static AiaOcspServiceConfiguration getAiaOcspServiceConfiguration() throws JceException {
         return new AiaOcspServiceConfiguration(
-            newHashSet(AIA_ESTEID_2015, TEST_ESTEID_2015),
+            newHashSet(TEST_ESTEID_2015),
             CertificateValidator.buildTrustAnchorsFromCertificates(TRUSTED_CA_CERTIFICATES),
             CertificateValidator.buildCertStoreFromCertificates(TRUSTED_CA_CERTIFICATES));
     }
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java
index 06264bff..3f1e6a78 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java
index e9e8e9a7..c2bc585c 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,19 +24,31 @@
 
 import com.fasterxml.jackson.databind.exc.MismatchedInputException;
 import eu.webeid.security.authtoken.WebEidAuthToken;
-import eu.webeid.security.exceptions.*;
+import eu.webeid.security.exceptions.AuthTokenException;
+import eu.webeid.security.exceptions.AuthTokenParseException;
+import eu.webeid.security.exceptions.CertificateDecodingException;
+import eu.webeid.security.exceptions.CertificateExpiredException;
+import eu.webeid.security.exceptions.CertificateNotTrustedException;
+import eu.webeid.security.exceptions.CertificateNotYetValidException;
+import eu.webeid.security.exceptions.UserCertificateDisallowedPolicyException;
+import eu.webeid.security.exceptions.UserCertificateMissingPurposeException;
+import eu.webeid.security.exceptions.UserCertificateRevokedException;
+import eu.webeid.security.exceptions.UserCertificateWrongPurposeException;
 import eu.webeid.security.testutil.AbstractTestWithValidator;
 import eu.webeid.security.testutil.AuthTokenValidators;
-import eu.webeid.security.testutil.Dates;
+import eu.webeid.security.util.DateAndTime;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
 
 import java.security.cert.CertificateException;
-import java.text.ParseException;
 
+import static eu.webeid.security.testutil.DateMocker.mockDate;
+import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.mockStatic;
 
 class AuthTokenCertificateTest extends AbstractTestWithValidator {
 
@@ -46,7 +58,7 @@ class AuthTokenCertificateTest extends AbstractTestWithValidator {
         "\"signature\":\"arx164xRiwhIQDINe0J+ZxJWZFOQTx0PBtOaWaxAe7gofEIHRIbV1w0sOCYBJnvmvMem9hU4nc2+iJx2x8poYck4Z6eI3GwtiksIec3XQ9ZIk1n/XchXnmPn3GYV+HzJ\"," +
         "\"format\":\"web-eid:1\"}";
 
-    private static final String MISSING_PURPOSE_CERT = "MIICxjCCAa6gAwIBAgIJANTbd26vS6fmMA0GCSqGSIb3DQEBBQUAMBUxEzARBgNVBAMTCndlYi1laWQuZXUwHhcNMjAwOTI0MTIyNDMzWhcNMzAwOTIyMTIyNDMzWjAVMRMwEQYDVQQDEwp3ZWItZWlkLmV1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAza5qBFu5fvs47rx3o9yzBVfIxHjMotID8ppkwWVen/uFxlqsRVi+XnWkggW+K8X45inAnBAVi1rIw7GQNdacSHglyvQfwM64AallmD0+K+QgbqxcO9fvRvlAeISENBc2bGgqTIytPEON5ZmazzbOZjqY3M1QcPlPZOeUm6M9ZcZFhsxpiB4gwZUic9tnCz9eujd6k6DzNVfSRaJcpGA5hJ9aKH4vXS3x7anewna+USEXkRb4Il5zSlZR0i1yrVA1YNOxCG/+GgWvXfvXwdQ0z9BpGwNEyc0mRDNx+umaTukz9t+7/qTcB2JLTuiwM9Gqg5sDDnzPlcZSa7GnIU0MLQIDAQABoxkwFzAVBgNVHREEDjAMggp3ZWItZWlkLmV1MA0GCSqGSIb3DQEBBQUAA4IBAQAYGkBhTlet47uw3JYunYo6dj4nGWSGV4x6LYjCp5QlAmGd28HpC1RFB3ba+inwW8SP69kEOcB0sJQAZ/tV90oCATNsy/Whg/TtiHISL2pr1dyBoKDRWbgTp8jjzcp2Bj9nL14aqpj1t4K1lcoYETX41yVmyyJu6VFs80M5T3yikm2giAhszjChnjyoT2kaEKoua9EUK9SS27pVltgbbvtmeTp3ZPHtBfiDOATL6E03RZ5WfMLRefI796a+RcznnudzQHhMSwcjLpMDgIWpUU4OU7RiwrU+S3MrvgzCjkWh2MGu/OGLB+d3JZoW+eCvigoshmAsbJCMLbh4N78BCPqk";
+    private static final String MISSING_KEY_USAGE_CERT = "MIICxjCCAa6gAwIBAgIJANTbd26vS6fmMA0GCSqGSIb3DQEBBQUAMBUxEzARBgNVBAMTCndlYi1laWQuZXUwHhcNMjAwOTI0MTIyNDMzWhcNMzAwOTIyMTIyNDMzWjAVMRMwEQYDVQQDEwp3ZWItZWlkLmV1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAza5qBFu5fvs47rx3o9yzBVfIxHjMotID8ppkwWVen/uFxlqsRVi+XnWkggW+K8X45inAnBAVi1rIw7GQNdacSHglyvQfwM64AallmD0+K+QgbqxcO9fvRvlAeISENBc2bGgqTIytPEON5ZmazzbOZjqY3M1QcPlPZOeUm6M9ZcZFhsxpiB4gwZUic9tnCz9eujd6k6DzNVfSRaJcpGA5hJ9aKH4vXS3x7anewna+USEXkRb4Il5zSlZR0i1yrVA1YNOxCG/+GgWvXfvXwdQ0z9BpGwNEyc0mRDNx+umaTukz9t+7/qTcB2JLTuiwM9Gqg5sDDnzPlcZSa7GnIU0MLQIDAQABoxkwFzAVBgNVHREEDjAMggp3ZWItZWlkLmV1MA0GCSqGSIb3DQEBBQUAA4IBAQAYGkBhTlet47uw3JYunYo6dj4nGWSGV4x6LYjCp5QlAmGd28HpC1RFB3ba+inwW8SP69kEOcB0sJQAZ/tV90oCATNsy/Whg/TtiHISL2pr1dyBoKDRWbgTp8jjzcp2Bj9nL14aqpj1t4K1lcoYETX41yVmyyJu6VFs80M5T3yikm2giAhszjChnjyoT2kaEKoua9EUK9SS27pVltgbbvtmeTp3ZPHtBfiDOATL6E03RZ5WfMLRefI796a+RcznnudzQHhMSwcjLpMDgIWpUU4OU7RiwrU+S3MrvgzCjkWh2MGu/OGLB+d3JZoW+eCvigoshmAsbJCMLbh4N78BCPqk";
     private static final String WRONG_PURPOSE_CERT = "MIIEBDCCA2WgAwIBAgIQGIgoZxFL7VZbyFH7MAVEkTAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTE4MTAxODA5MjcyM1oXDTIzMTAxNzIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT3SZB34CUGYhQyLsLd9b2ihv35q7NT47Id9ugLIdgg3NSFDccH6rV16D2m8DKfuD2mn3V6QdaaZnbWF4YdDK1W0C9kLNsB70ob//y39pugMftepmQpJcBGPqug81tf5jujggHDMIIBvzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5EhAQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFPhJx7ro54+N8r2ByiZXzZyWBbjFMGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsG/wUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezBzBggrBgEFBQcBAQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MDUGCCsGAQUFBzAChilodHRwOi8vYy5zay5lZS9UZXN0X29mX0VTVEVJRDIwMTguZGVyLmNydDAKBggqhkjOPQQDBAOBjAAwgYgCQgFi5XSCFGgsc8SKLWwMBWS0nu/20FjEqh6OGvsI4iPctNDkinsxcYgARdfqPsNnDX+KjALKPEKZCLKRixGL2kPLMgJCAQFXP9gstThxlj/1Q5YFb7KWhPWFiKgQEi9JdvxJQNXLkWV9onEh96mRFgv4IJJpGazuoSMZtzNpyBxmM0dwnxOf";
     private static final String WRONG_POLICY_CERT = "MIIEATCCA2OgAwIBAgIQOWkBWXNDJm1byFd3XsWkvjAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTE4MTAxODA5NTA0N1oXDTIzMTAxNzIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAR5k1lXzvSeI9O/1s1pZvjhEW8nItJoG0EBFxmLEY6S7ki1vF2Q3TEDx6dNztI1Xtx96cs8r4zYTwdiQoDg7k3diUuR9nTWGxQEMO1FDo4Y9fAmiPGWT++GuOVoZQY3XxijggHBMIIBvTAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBFBgNVHSAEPjA8MDAGCSsGAQQBzh8BAzAjMCEGCCsGAQUFBwIBFhVodHRwczovL3d3dy5zay5lZS9DUFMwCAYGBACPegECMB8GA1UdEQQYMBaBFDM4MDAxMDg1NzE4QGVlc3RpLmVlMB0GA1UdDgQWBBTkLL00CRAVTDEpocmV+W4m2CbmwDBhBggrBgEFBQcBAwRVMFMwUQYGBACORgEFMEcwRRY/aHR0cHM6Ly9zay5lZS9lbi9yZXBvc2l0b3J5L2NvbmRpdGlvbnMtZm9yLXVzZS1vZi1jZXJ0aWZpY2F0ZXMvEwJFTjAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHwYDVR0jBBgwFoAUwISZKcROnzsCNPaZ4QpWAAgpPnswcwYIKwYBBQUHAQEEZzBlMCwGCCsGAQUFBzABhiBodHRwOi8vYWlhLmRlbW8uc2suZWUvZXN0ZWlkMjAxODA1BggrBgEFBQcwAoYpaHR0cDovL2Muc2suZWUvVGVzdF9vZl9FU1RFSUQyMDE4LmRlci5jcnQwCgYIKoZIzj0EAwQDgYsAMIGHAkIB9VLJjHbS2bYudRatkEeMFJAMKbJ4bAVdh0KlFxWASexF5ywpGl43WSpB6QAXzNEBMe1FIWiOIud44iexNWO1jgACQQ1+M+taZ4hyWqSNW5DCIiUP7Yu4WvH3SUjEqQHbOQshyMh5EM1pVcvOn/ZgOxLt6ETv9avnhVMw2zTd1b8u4EFk";
 
@@ -56,21 +68,20 @@ class AuthTokenCertificateTest extends AbstractTestWithValidator {
     private static final String EXPIRED_ECDSA_CERT = "MIIF0TCCA7mgAwIBAgIQMBVFXroEt3hZ8FHcKKE65TANBgkqhkiG9w0BAQsFADBjMQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1czEXMBUGA1UEYQwOTlRSRUUtMTA3NDcwMTMxFzAVBgNVBAMMDkVTVEVJRC1TSyAyMDE1MB4XDTE3MTAyNTA4NTcwMFoXDTIxMDIxMDIxNTk1OVowgYsxCzAJBgNVBAYTAkVFMQ8wDQYDVQQKDAZFU1RFSUQxFzAVBgNVBAsMDmF1dGhlbnRpY2F0aW9uMR4wHAYDVQQDDBVUT09NLE1BUlQsMzc2MDIwNDAzMzQxDTALBgNVBAQMBFRPT00xDTALBgNVBCoMBE1BUlQxFDASBgNVBAUTCzM3NjAyMDQwMzM0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAExS1YQQBDLVvOi0a2GA5Y34AXODpx0AL8eKDOB7BjwBc/FAyVExhfb6O+lT5Tnaec3GnT4JNRyeV8d82L8cyOgFn4PWc+5cjFdmcZjJbtCvgyBOQQ831tteIDL2XSrvZEo4ICBDCCAgAwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCA4gwUwYDVR0gBEwwSjA+BgkrBgEEAc4fAQEwMTAvBggrBgEFBQcCARYjaHR0cHM6Ly93d3cuc2suZWUvcmVwb3NpdG9vcml1bS9DUFMwCAYGBACPegECMB8GA1UdEQQYMBaBFG1hcnQudG9vbS4zQGVlc3RpLmVlMB0GA1UdDgQWBBSzneoLqtqbvHvJ19cjhp2XR5ovQTAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHwYDVR0jBBgwFoAUs6uIvJnVYqSFKgjNtB1yO4NyR1EwYQYIKwYBBQUHAQMEVTBTMFEGBgQAjkYBBTBHMEUWP2h0dHBzOi8vc2suZWUvZW4vcmVwb3NpdG9yeS9jb25kaXRpb25zLWZvci11c2Utb2YtY2VydGlmaWNhdGVzLxMCRU4wagYIKwYBBQUHAQEEXjBcMCcGCCsGAQUFBzABhhtodHRwOi8vYWlhLnNrLmVlL2VzdGVpZDIwMTUwMQYIKwYBBQUHMAKGJWh0dHA6Ly9jLnNrLmVlL0VTVEVJRC1TS18yMDE1LmRlci5jcnQwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL3d3dy5zay5lZS9jcmxzL2VzdGVpZC9lc3RlaWQyMDE1LmNybDANBgkqhkiG9w0BAQsFAAOCAgEAOXTvktUXqPgaK/uxzgH0xSEYClBAWIQaNgpqY5lwsQtgQnpfKlsADqMZxCp7UuuMvQmpDbBxv1kIr0oG1uUXrUtPw81XOH1ClwPPXWpg9VRTAetNbHTBbHDyzuXQMNeDmrntChs+BteletejGD+aYG39HGMlrMbGQZOgvQrpYHMDek0ckCPEsZRXqUP0g7Ie7uBQhz5At7l4EDAeOW8xGoI6t+Ke4GedccXKef60w2ZIIDzvOFHPTc6POCsIlFtF/nCKwVi7GoQKjbUbM5OdBLZ0jyLq2LvzZuT86Jo8wObziuSzApGlBexHAqLrR83q+/Xl61yPnFf3w2kAfS9kBjeunzTH7Jm3pNT3Zq9JRLvEDqtpOPqr4zm9nG6OSghFU6tySkpQ5HiakGpMcnt5o5KuXhQ+Dg317tdXPyQkSiuJ9NfEBW0ijrwO12SVRzYo/jRl4ZQUkAEEUSMEsC6gTsZypPdIsLDVoQWTytHDU89s1xJDn4HulPl12dFnrhlLeX4RxOjDxppZxdjBU0FoJoDB0qwEAN2TMAPJWh+Pp9mFuS/u0dht9sKvAkpx+o0Z7v7QMz03XlzCHOLTIK+f81Rjokl8f+wiog5Ojj0wZkDe6DuQC9L5uDey3PJHv3naVovhs7jrEJu+yrsLue/OHhAgWRh2S75/wlVPHPEE44k=";
     private static final String REVOKED_CERT = "MIIERDCCA6agAwIBAgIQSs8/WoDixVxbKRhNnF/GEzAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTE4MDYxOTE0NTA1M1oXDTIwMDEwMjIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAR/jopNG3KL0ZQUvO4OGSvcaqUtFDm3azOtsM2VRp666r0d36Zh0Zx/xej8f+SzEfWvvDT1HQLo3USiSbYn1FyNHTNxifV+Zvf6StXJAkdu24d1UvKbf+LylglO/yS7o4ijggIEMIICADAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5F/AQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFEQA6/1GXJtp+6czUzorhEJ7B95pMGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezB/BggrBgEFBQcBAQRzMHEwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MEEGCCsGAQUFBzAChjVodHRwczovL3NrLmVlL3VwbG9hZC9maWxlcy9URVNUX29mX0VTVEVJRDIwMTguZGVyLmNydDAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vYy5zay5lZS90ZXN0X2VzdGVpZDIwMTguY3JsMAoGCCqGSM49BAMEA4GLADCBhwJBcmcfLC+HcSJ6BuRrDGL+K+7BAW8BfAiiWWAuBV4ebLkbbAWmkc9dSKgr4BEGEt90xDTQ85yW4SjGulFXu9C3yQsCQgETaXTs3Hp6vDAcQYL8Bx4BO3DwJbDuD4BUJyT0+9HQiFCQmTQ4xrNjeaeOwRWyMOM9z5ORMeJCiQUyil1x4YPIbg==";
 
+    private MockedStatic<DateAndTime.DefaultClock> mockedClock;
+
     @Override
     @BeforeEach
     protected void setup() {
         super.setup();
+        mockedClock = mockStatic(DateAndTime.DefaultClock.class);
         // Ensure that the certificates do not expire.
-        mockDate("2021-03-01");
+        mockDate("2021-08-01", mockedClock);
     }
 
     @AfterEach
-    public void tearDown() {
-        try {
-            Dates.resetMockedCertificateValidatorDate();
-        } catch (NoSuchFieldException | IllegalAccessException e) {
-            throw new RuntimeException(e);
-        }
+    void tearDown() {
+        mockedClock.close();
     }
 
     @Test
@@ -135,8 +146,8 @@ void whenCertificateFieldIsNotCertificate_thenParsingFails() throws AuthTokenExc
     }
 
     @Test
-    void whenCertificatePurposeIsMissing_thenValidationFails() throws AuthTokenException {
-        final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", MISSING_PURPOSE_CERT);
+    void whenCertificateKeyUsageIsMissing_thenValidationFails() throws AuthTokenException {
+        final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", MISSING_KEY_USAGE_CERT);
         assertThatThrownBy(() -> validator
             .validate(token, VALID_CHALLENGE_NONCE))
             .isInstanceOf(UserCertificateMissingPurposeException.class);
@@ -168,6 +179,7 @@ void whenCertificatePolicyIsDisallowed_thenValidationFails() throws Exception {
 
     @Test
     void whenUsingOldMobileIdCertificate_thenValidationFails() throws AuthTokenException {
+        mockDate("2021-03-01", mockedClock);
         final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", OLD_MOBILE_ID_CERT);
         assertThatThrownBy(() -> validator
             .validate(token, VALID_CHALLENGE_NONCE))
@@ -209,44 +221,58 @@ void whenCertificateIsExpiredEcdsa_thenValidationFails() throws AuthTokenExcepti
 
     @Test
     void whenUserCertificateIsNotYetValid_thenValidationFails() {
-        mockDate("2018-10-17");
+        mockDate("2018-10-17", mockedClock);
         assertThatThrownBy(() -> validator
             .validate(validAuthToken, VALID_CHALLENGE_NONCE))
             .isInstanceOf(CertificateNotYetValidException.class)
             .hasMessage("User certificate is not yet valid");
     }
 
+    // In this case both CA and user certificate are not yet valid, we expect the user certificate to be checked first.
     @Test
-    void whenTrustedCACertificateIsNotYetValid_thenValidationFails() {
-        mockDate("2018-08-17");
+    void whenTrustedCACertificateIsNotYetValid_thenUserCertValidationFails() {
+        mockDate("2018-08-17", mockedClock);
         assertThatThrownBy(() -> validator
             .validate(validAuthToken, VALID_CHALLENGE_NONCE))
             .isInstanceOf(CertificateNotYetValidException.class)
-            .hasMessage("Trusted CA certificate is not yet valid");
+            .hasMessage("User certificate is not yet valid");
     }
 
     @Test
     void whenUserCertificateIsNoLongerValid_thenValidationFails() {
-        mockDate("2024-10-19");
+        mockDate("2026-10-19", mockedClock);
         assertThatThrownBy(() -> validator
             .validate(validAuthToken, VALID_CHALLENGE_NONCE))
             .isInstanceOf(CertificateExpiredException.class)
             .hasMessage("User certificate has expired");
     }
 
+    // In this case both CA and user certificate have expired, we expect the user certificate to be checked first.
     @Test
-    void whenTrustedCACertificateIsNoLongerValid_thenValidationFails() {
-        mockDate("2033-10-19");
+    void whenTrustedCACertificateIsNoLongerValid_thenUserCertValidationFails() {
+        mockDate("2033-10-19", mockedClock);
         assertThatThrownBy(() -> validator
             .validate(validAuthToken, VALID_CHALLENGE_NONCE))
             .isInstanceOf(CertificateExpiredException.class)
-            .hasMessage("Trusted CA certificate has expired");
+            .hasMessage("User certificate has expired");
+    }
+
+    // The certificate validation process must only check the expiration of the CA certificate that is directly part of
+    // the user's certificate chain. Expired but unrelated CA certificates must not cause exceptions.
+    @Test
+    void whenUnrelatedCACertificateIsExpired_thenValidationSucceeds() throws Exception {
+        mockDate("2024-07-01", mockedClock);
+        final AuthTokenValidator validatorWithExpiredUnrelatedTrustedCA = AuthTokenValidators.getAuthTokenValidatorWithJuly2024ExpiredUnrelatedTrustedCA();
+
+        assertThatCode(() -> validatorWithExpiredUnrelatedTrustedCA
+            .validate(validAuthToken, VALID_CHALLENGE_NONCE))
+            .doesNotThrowAnyException();
     }
 
     @Test
     @Disabled("A new designated test OCSP responder certificate was issued whose validity period no longer overlaps with the revoked certificate")
     void whenCertificateIsRevoked_thenOcspCheckFails() throws Exception {
-        mockDate("2020-01-01");
+        mockDate("2020-01-01", mockedClock);
         final AuthTokenValidator validatorWithOcspCheck = AuthTokenValidators.getAuthTokenValidatorWithOcspCheck();
         final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", REVOKED_CERT);
         assertThatThrownBy(() -> validatorWithOcspCheck
@@ -257,7 +283,7 @@ void whenCertificateIsRevoked_thenOcspCheckFails() throws Exception {
     @Test
     @Disabled("A new designated test OCSP responder certificate was issued whose validity period no longer overlaps with the revoked certificate")
     void whenCertificateIsRevoked_thenOcspCheckWithDesignatedOcspServiceFails() throws Exception {
-        mockDate("2020-01-01");
+        mockDate("2020-01-01", mockedClock);
         final AuthTokenValidator validatorWithOcspCheck = AuthTokenValidators.getAuthTokenValidatorWithDesignatedOcspCheck();
         final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", REVOKED_CERT);
         assertThatThrownBy(() -> validatorWithOcspCheck
@@ -273,12 +299,4 @@ void whenCertificateCaIsNotPartOfTrustChain_thenValidationFails() throws Excepti
             .isInstanceOf(CertificateNotTrustedException.class);
     }
 
-    private void mockDate(String date) {
-        try {
-            Dates.setMockedCertificateValidatorDate(Dates.create(date));
-        } catch (ParseException | NoSuchFieldException | IllegalAccessException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
 }
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java
index 8fc00bdd..2408c790 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -27,13 +27,17 @@
 import eu.webeid.security.exceptions.AuthTokenSignatureValidationException;
 import eu.webeid.security.testutil.AbstractTestWithValidator;
 import eu.webeid.security.testutil.AuthTokenValidators;
+import eu.webeid.security.util.DateAndTime;
 import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
 
 import java.security.cert.X509Certificate;
 
+import static eu.webeid.security.testutil.DateMocker.mockDate;
 import static eu.webeid.security.util.Strings.toTitleCase;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.mockStatic;
 
 class AuthTokenSignatureTest extends AbstractTestWithValidator {
 
@@ -47,15 +51,15 @@ class AuthTokenSignatureTest extends AbstractTestWithValidator {
     void whenValidTokenAndNonce_thenValidationSucceeds() throws Exception {
         final X509Certificate result = validator.validate(validAuthToken, VALID_CHALLENGE_NONCE);
 
-        assertThat(CertificateData.getSubjectCN(result))
+        assertThat(CertificateData.getSubjectCN(result).get())
             .isEqualTo("JÕEORG\\,JAAK-KRISTJAN\\,38001085718");
-        assertThat(toTitleCase(CertificateData.getSubjectGivenName(result)))
+        assertThat(toTitleCase(CertificateData.getSubjectGivenName(result).get()))
             .isEqualTo("Jaak-Kristjan");
-        assertThat(toTitleCase(CertificateData.getSubjectSurname(result)))
+        assertThat(toTitleCase(CertificateData.getSubjectSurname(result).get()))
             .isEqualTo("Jõeorg");
-        assertThat(CertificateData.getSubjectIdCode(result))
+        assertThat(CertificateData.getSubjectIdCode(result).get())
             .isEqualTo("PNOEE-38001085718");
-        assertThat(CertificateData.getSubjectCountryCode(result))
+        assertThat(CertificateData.getSubjectCountryCode(result).get())
             .isEqualTo("EE");
     }
 
@@ -77,11 +81,15 @@ void whenValidTokenAndWrongOrigin_thenValidationFails() throws Exception {
 
     @Test
     void whenTokenWithWrongCert_thenValidationFails() throws Exception {
-        final AuthTokenValidator authTokenValidator = AuthTokenValidators.getAuthTokenValidator();
-        final WebEidAuthToken authTokenWithWrongCert = authTokenValidator.parse(AUTH_TOKEN_WRONG_CERT);
-        assertThatThrownBy(() -> authTokenValidator
-            .validate(authTokenWithWrongCert, VALID_CHALLENGE_NONCE))
-            .isInstanceOf(AuthTokenSignatureValidationException.class);
+        // Ensure that the certificate does not expire.
+        try (final MockedStatic<DateAndTime.DefaultClock> mockedClock = mockStatic(DateAndTime.DefaultClock.class)) {
+            mockDate("2024-08-01", mockedClock);
+            final AuthTokenValidator authTokenValidator = AuthTokenValidators.getAuthTokenValidator();
+            final WebEidAuthToken authTokenWithWrongCert = authTokenValidator.parse(AUTH_TOKEN_WRONG_CERT);
+            assertThatThrownBy(() -> authTokenValidator
+                .validate(authTokenWithWrongCert, VALID_CHALLENGE_NONCE))
+                .isInstanceOf(AuthTokenSignatureValidationException.class);
+        }
     }
 
 }
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java
index 87970f1a..fc7edd0c 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -23,6 +23,7 @@
 package eu.webeid.security.validator;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.ObjectReader;
 import eu.webeid.security.certificate.CertificateLoader;
 import org.junit.jupiter.api.Test;
 import eu.webeid.security.authtoken.WebEidAuthToken;
@@ -36,9 +37,9 @@
 
 class AuthTokenSignatureValidatorTest {
 
-    private static final ObjectMapper objectMapper = new ObjectMapper();
+    private static final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class);
 
-    static String VALID_RS256_AUTH_TOKEN = "{\"algorithm\":\"RS256\"," +
+    private static final String VALID_RS256_AUTH_TOKEN = "{\"algorithm\":\"RS256\"," +
         "\"unverifiedCertificate\":\"MIIGvjCCBKagAwIBAgIQT7aXeR+zWlBb2Gbar+AFaTANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCTFYxOTA3BgNVBAoMMFZBUyBMYXR2aWphcyBWYWxzdHMgcmFkaW8gdW4gdGVsZXbEq3ppamFzIGNlbnRyczEaMBgGA1UEYQwRTlRSTFYtNDAwMDMwMTEyMDMxHTAbBgNVBAMMFERFTU8gTFYgZUlEIElDQSAyMDE3MB4XDTE4MTAzMDE0MTI0MloXDTIzMTAzMDE0MTI0MlowcDELMAkGA1UEBhMCTFYxHDAaBgNVBAMME0FORFJJUyBQQVJBVURaScWFxaAxFTATBgNVBAQMDFBBUkFVRFpJxYXFoDEPMA0GA1UEKgwGQU5EUklTMRswGQYDVQQFExJQTk9MVi0zMjE5MjItMzMwMzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDXkra3rDOOt5K6OnJcg/Xt6JOogPAUBX2kT9zWelze7WSuPx2Ofs//0JoBQ575IVdh3JpLhfh7g60YYi41M6vNACVSNaFOxiEvE9amSFizMiLk5+dp+79rymqOsVQG8CSu8/RjGGlDsALeb3N/4pUSTGXUwSB64QuFhOWjAcmKPhHeYtry0hK3MbwwHzFhYfGpo/w+PL14PEdJlpL1UX/aPyT0Zq76Z4T/Z3PqbTmQp09+2b0thC0JIacSkyJuTu8fVRQvse+8UtYC6Kt3TBLZbPtqfAFSXWbuE47Lc2o840NkVlMHVAesoRAfiQxsK35YWFT0rHPWbLjX6ySiaL25AgMBAAGjggI+MIICOjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQUHZWimPze2GXULNaP4EFVdF+MWKQwHwYDVR0jBBgwFoAUj2jOvOLHQCFTCUK75Z4djEvNvTgwgfsGA1UdIASB8zCB8DA7BgYEAI96AQIwMTAvBggrBgEFBQcCARYjaHR0cHM6Ly93d3cuZXBhcmFrc3RzLmx2L3JlcG9zaXRvcnkwgbAGDCsGAQQBgfo9AgECATCBnzAvBggrBgEFBQcCARYjaHR0cHM6Ly93d3cuZXBhcmFrc3RzLmx2L3JlcG9zaXRvcnkwbAYIKwYBBQUHAgIwYAxexaBpcyBzZXJ0aWZpa8SBdHMgaXIgaWVrxLxhdXRzIExhdHZpamFzIFJlcHVibGlrYXMgaXpzbmllZ3TEgSBwZXJzb251IGFwbGllY2lub8WhxIEgZG9rdW1lbnTEgTB9BggrBgEFBQcBAQRxMG8wQgYIKwYBBQUHMAKGNmh0dHA6Ly9kZW1vLmVwYXJha3N0cy5sdi9jZXJ0L2RlbW9fTFZfZUlEX0lDQV8yMDE3LmNydDApBggrBgEFBQcwAYYdaHR0cDovL29jc3AucHJlcC5lcGFyYWtzdHMubHYwSAYDVR0fBEEwPzA9oDugOYY3aHR0cDovL2RlbW8uZXBhcmFrc3RzLmx2L2NybC9kZW1vX0xWX2VJRF9JQ0FfMjAxN18zLmNybDANBgkqhkiG9w0BAQsFAAOCAgEAAOVoRbnMv2UXWYHgnmO9Zg9u8F1YvJiZPMeTYE2CVaiq0nXe4Mq0X5tWcsEiRpGQF9e0dWC6V5m6EmAsHxIRL4chZKRrIrPEiWtP3zyRI1/X2y5GwSUyZmgxkuSOHHw3UjzjrnOoI9izpC0OSNeumqpjT/tLAi35sktGkK0onEUPWGQnZLqd/hzykm+H/dmD27nOnfCJOSqbegLSbhV2w/WAII+IUD3vJ06F6rf9ZN8xbrGkPO8VMCIDIt0eBKFxBdSOgpsTfbERbjQJ+nFEDYhD0bFNYMsFSGnZiWpNaCcZSkk4mtNUa8sNXyaFQGIZk6NjQ/fsBANhUoxFz7rUKrRYqk356i8KFDZ+MJqUyodKKyW9oz+IO5eJxnL78zRbxD+EfAUmrLXOjmGIzU95RR1smS4cirrrPHqGAWojBk8hKbjNTJl9Tfbnsbc9/FUBJLVZAkCi631KfRLQ66bn8N0mbtKlNtdX0G47PXTy7SJtWwDtKQ8+qVpduc8xHLntbdAzie3mWyxA1SBhQuZ9BPf5SPBImWCNpmZNCTmI2e+4yyCnmG/kVNilUAaODH/fgQXFGdsKO/XATFohiies28twkEzqtlVZvZbpBhbJCHYVnQXMhMKcnblkDqXWcSWd3QAKig2yMH95uz/wZhiV+7tZ7cTgwcbCzIDCfpwBC3E=\"," +
         "\"issuerApp\":\"https://web-eid.eu/web-eid-app/releases/2.0.0+0\"," +
         "\"signature\":\"xsjXsQvVYXWcdV0YPhxLthJxtf0//R8p9WFFlYJGRARrl1ruyoAUwl0xeHgeZOKeJtwiCYCNWJzCG3VM3ydgt92bKhhk1u0JXIPVqvOkmDY72OCN4q73Y8iGSPVTgjk93TgquHlodf7YcqZNhutwNNf3oldHEWJD5zmkdwdpBFXgeOwTAdFwGljDQZbHr3h1Dr+apUDuloS0WuIzUuu8YXN2b8lh8FCTlF0G0DEjhHd/MGx8dbe3UTLHmD7K9DXv4zLJs6EF9i2v/C10SIBQDkPBSVPqMxCDPECjbEPi2+ds94eU7ThOhOQlFFtJ4KjQNTUa2crSixH7cYZF2rNNmA==\"," +
@@ -49,7 +50,7 @@ void whenValidES384Signature_thenSucceeds() throws Exception {
         final AuthTokenSignatureValidator signatureValidator =
             new AuthTokenSignatureValidator(URI.create("https://ria.ee"));
 
-        final WebEidAuthToken authToken = objectMapper.readValue(VALID_AUTH_TOKEN, WebEidAuthToken.class);
+        final WebEidAuthToken authToken = OBJECT_READER.readValue(VALID_AUTH_TOKEN);
         final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.getUnverifiedCertificate());
 
         assertThatCode(() -> signatureValidator
@@ -62,7 +63,7 @@ void whenValidRS256Signature_thenSucceeds() throws Exception {
         final AuthTokenSignatureValidator signatureValidator =
             new AuthTokenSignatureValidator(URI.create("https://ria.ee"));
 
-        final WebEidAuthToken authToken = objectMapper.readValue(VALID_RS256_AUTH_TOKEN, WebEidAuthToken.class);
+        final WebEidAuthToken authToken = OBJECT_READER.readValue(VALID_RS256_AUTH_TOKEN);
         final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.getUnverifiedCertificate());
 
         assertThatCode(() -> signatureValidator
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java
index d7107ca5..be79c0cb 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java
index a3dfad4e..8e58466f 100644
--- a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java
+++ b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -26,10 +26,15 @@
 import org.junit.jupiter.api.Test;
 
 import java.net.URI;
+import java.time.Duration;
 
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
-class AuthTokenValidatorBuilderTest {
+public class AuthTokenValidatorBuilderTest {
+
+    // AuthTokenValidationConfiguration has a package-private constructor, but some tests need access to it outside its package.
+    // Provide a public accessor to it for these tests.
+    public static final AuthTokenValidationConfiguration CONFIGURATION = new AuthTokenValidationConfiguration();
 
     final AuthTokenValidatorBuilder builder = new AuthTokenValidatorBuilder();
 
@@ -81,4 +86,30 @@ void testValidatorOriginNotValidSyntax() {
             .hasMessageStartingWith("An URI syntax exception occurred");
     }
 
+    @Test
+    void testInvalidOcspResponseTimeSkew() throws Exception {
+        final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder()
+            .withAllowedOcspResponseTimeSkew(Duration.ofMinutes(-1));
+        assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build)
+            .isInstanceOf(IllegalArgumentException.class)
+            .hasMessageStartingWith("Allowed OCSP response time-skew must be greater than zero");
+    }
+
+    @Test
+    void testInvalidMaxOcspResponseThisUpdateAge() throws Exception {
+        final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder()
+            .withMaxOcspResponseThisUpdateAge(Duration.ZERO);
+        assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build)
+            .isInstanceOf(IllegalArgumentException.class)
+            .hasMessageStartingWith("Max OCSP response thisUpdate age must be greater than zero");
+    }
+
+    @Test
+    void testInvalidOcspRequestTimeout() throws Exception {
+        final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder()
+            .withOcspRequestTimeout(Duration.ofMinutes(-1));
+        assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build)
+            .isInstanceOf(IllegalArgumentException.class)
+            .hasMessageStartingWith("OCSP request timeout must be greater than zero");
+    }
 }
diff --git a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java b/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java
index 0f4efb1e..ee1aecb4 100644
--- a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java
+++ b/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,9 +22,15 @@
 
 package eu.webeid.security.validator.certvalidators;
 
+import eu.webeid.security.exceptions.CertificateExpiredException;
+import eu.webeid.security.exceptions.CertificateNotTrustedException;
 import eu.webeid.security.exceptions.JceException;
+import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
+import eu.webeid.security.exceptions.UserCertificateRevokedException;
+import eu.webeid.security.util.DateAndTime;
 import eu.webeid.security.validator.ocsp.OcspClient;
 import eu.webeid.security.validator.ocsp.OkHttpOcspClient;
+import eu.webeid.security.validator.ocsp.OcspServiceProvider;
 import okhttp3.MediaType;
 import okhttp3.Protocol;
 import okhttp3.Request;
@@ -33,34 +39,32 @@
 import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
 import org.bouncycastle.cert.ocsp.OCSPException;
 import org.bouncycastle.cert.ocsp.OCSPResp;
-import org.jetbrains.annotations.NotNull;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
-import eu.webeid.security.exceptions.CertificateNotTrustedException;
-import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
-import eu.webeid.security.exceptions.UserCertificateRevokedException;
-import eu.webeid.security.validator.ocsp.OcspServiceProvider;
+import org.mockito.MockedStatic;
 
 import java.io.IOException;
 import java.io.InputStream;
 import java.lang.reflect.Field;
+import java.net.UnknownHostException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.time.Duration;
 import java.util.Objects;
 
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static eu.webeid.security.testutil.Certificates.getJaakKristjanEsteid2018Cert;
 import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA;
+import static eu.webeid.security.testutil.DateMocker.mockDate;
 import static eu.webeid.security.testutil.OcspServiceMaker.getAiaOcspServiceProvider;
 import static eu.webeid.security.testutil.OcspServiceMaker.getDesignatedOcspServiceProvider;
+import static eu.webeid.security.validator.AuthTokenValidatorBuilderTest.CONFIGURATION;
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.mockito.Mockito.mockStatic;
 
 class SubjectCertificateNotRevokedValidatorTest {
 
-    private static final MediaType OCSP_RESPONSE = MediaType.get("application/ocsp-response");
-
     private final OcspClient ocspClient = OkHttpOcspClient.build(Duration.ofSeconds(5));
     private SubjectCertificateTrustedValidator trustedValidator;
     private X509Certificate estEid2018Cert;
@@ -74,7 +78,7 @@ void setUp() throws Exception {
 
     @Test
     void whenValidAiaOcspResponderConfiguration_thenSucceeds() throws Exception {
-        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(ocspClient);
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspClient, getAiaOcspServiceProvider());
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .doesNotThrowAnyException();
@@ -84,7 +88,7 @@ void whenValidAiaOcspResponderConfiguration_thenSucceeds() throws Exception {
     @Disabled("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date")
     void whenValidDesignatedOcspResponderConfiguration_thenSucceeds() throws Exception {
         final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider();
-        final SubjectCertificateNotRevokedValidator validator = new SubjectCertificateNotRevokedValidator(trustedValidator, ocspClient, ocspServiceProvider);
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider);
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .doesNotThrowAnyException();
@@ -94,7 +98,7 @@ void whenValidDesignatedOcspResponderConfiguration_thenSucceeds() throws Excepti
     @Disabled("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date")
     void whenValidOcspNonceDisabledConfiguration_thenSucceeds() throws Exception {
         final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider(false);
-        final SubjectCertificateNotRevokedValidator validator = new SubjectCertificateNotRevokedValidator(trustedValidator, ocspClient, ocspServiceProvider);
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider);
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .doesNotThrowAnyException();
@@ -103,34 +107,31 @@ void whenValidOcspNonceDisabledConfiguration_thenSucceeds() throws Exception {
     @Test
     void whenOcspUrlIsInvalid_thenThrows() throws Exception {
         final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("http://invalid.invalid");
-        final SubjectCertificateNotRevokedValidator validator = new SubjectCertificateNotRevokedValidator(trustedValidator, ocspClient, ocspServiceProvider);
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider);
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .isInstanceOf(UserCertificateOCSPCheckFailedException.class)
             .cause()
-            .isInstanceOf(IOException.class)
-            .hasMessageMatching("invalid.invalid: (Name or service not known|"
-                + "Temporary failure in name resolution)");
+            .isInstanceOf(UnknownHostException.class);
     }
 
     @Test
     void whenOcspRequestFails_thenThrows() throws Exception {
-        final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("https://web-eid-test.free.beeceptor.com");
-        final SubjectCertificateNotRevokedValidator validator = new SubjectCertificateNotRevokedValidator(trustedValidator, ocspClient, ocspServiceProvider);
+        final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("http://demo.sk.ee/ocsps");
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider);
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .isInstanceOf(UserCertificateOCSPCheckFailedException.class)
             .cause()
             .isInstanceOf(IOException.class)
-            .hasMessageStartingWith("OCSP request was not successful, response: Response{");
+            .hasMessageStartingWith("OCSP request was not successful, response: Response{protocol=http/1.1, code=404, message=Not Found, url=http://demo.sk.ee/ocsps}");
     }
 
     @Test
     void whenOcspRequestHasInvalidBody_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create("invalid", OCSP_RESPONSE))
-                .build());
+            getMockedResponse("invalid".getBytes())
+        );
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .isInstanceOf(UserCertificateOCSPCheckFailedException.class)
@@ -142,9 +143,8 @@ void whenOcspRequestHasInvalidBody_thenThrows() throws Exception {
     @Test
     void whenOcspResponseIsNotSuccessful_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(buildOcspResponseBodyWithInternalErrorStatus(), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(buildOcspResponseBodyWithInternalErrorStatus())
+        );
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -154,9 +154,8 @@ void whenOcspResponseIsNotSuccessful_thenThrows() throws Exception {
     @Test
     void whenOcspResponseHasInvalidCertificateId_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(buildOcspResponseBodyWithInvalidCertificateId(), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(buildOcspResponseBodyWithInvalidCertificateId())
+        );
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -166,9 +165,8 @@ void whenOcspResponseHasInvalidCertificateId_thenThrows() throws Exception {
     @Test
     void whenOcspResponseHasInvalidSignature_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(buildOcspResponseBodyWithInvalidSignature(), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(buildOcspResponseBodyWithInvalidSignature())
+        );
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -178,9 +176,8 @@ void whenOcspResponseHasInvalidSignature_thenThrows() throws Exception {
     @Test
     void whenOcspResponseHasInvalidResponderCert_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(buildOcspResponseBodyWithInvalidResponderCert(), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(buildOcspResponseBodyWithInvalidResponderCert())
+        );
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .isInstanceOf(UserCertificateOCSPCheckFailedException.class)
@@ -192,9 +189,8 @@ void whenOcspResponseHasInvalidResponderCert_thenThrows() throws Exception {
     @Test
     void whenOcspResponseHasInvalidTag_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(buildOcspResponseBodyWithInvalidTag(), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(buildOcspResponseBodyWithInvalidTag())
+        );
         assertThatCode(() ->
             validator.validateCertificateNotRevoked(estEid2018Cert))
             .isInstanceOf(UserCertificateOCSPCheckFailedException.class)
@@ -206,9 +202,8 @@ void whenOcspResponseHasInvalidTag_thenThrows() throws Exception {
     @Test
     void whenOcspResponseHas2CertResponses_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(getOcspResponseBytesFromResources("ocsp_response_with_2_responses.der"), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_with_2_responses.der"))
+        );
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -218,9 +213,8 @@ void whenOcspResponseHas2CertResponses_thenThrows() throws Exception {
     @Disabled("It is difficult to make Python and Java CertId equal, needs more work")
     void whenOcspResponseHas2ResponderCerts_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(getOcspResponseBytesFromResources("ocsp_response_with_2_responder_certs.der"), OCSP_RESPONSE))
-                .build());
+            getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_with_2_responder_certs.der"))
+        );
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -230,23 +224,24 @@ void whenOcspResponseHas2ResponderCerts_thenThrows() throws Exception {
     @Test
     void whenOcspResponseRevoked_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(getOcspResponseBytesFromResources("ocsp_response_revoked.der"), OCSP_RESPONSE))
-                .build());
-        assertThatExceptionOfType(UserCertificateRevokedException.class)
-            .isThrownBy(() ->
-                validator.validateCertificateNotRevoked(estEid2018Cert))
-            .withMessage("User certificate has been revoked: Revocation reason: 0");
+            getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_revoked.der"))
+        );
+        try (MockedStatic<DateAndTime.DefaultClock> mockedClock = mockStatic(DateAndTime.DefaultClock.class)) {
+            mockDate("2021-09-18", mockedClock);
+            assertThatExceptionOfType(UserCertificateRevokedException.class)
+                .isThrownBy(() ->
+                    validator.validateCertificateNotRevoked(estEid2018Cert))
+                .withMessage("User certificate has been revoked: Revocation reason: 0");
+        }
     }
 
     @Test
     void whenOcspResponseUnknown_thenThrows() throws Exception {
         final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("https://web-eid-test.free.beeceptor.com");
-        try (final Response response = getResponseBuilder()
-            .body(ResponseBody.create(getOcspResponseBytesFromResources("ocsp_response_unknown.der"), OCSP_RESPONSE))
-            .build()) {
-            final OcspClient client = (url, request) -> new OCSPResp(Objects.requireNonNull(response.body()).bytes());
-            final SubjectCertificateNotRevokedValidator validator = new SubjectCertificateNotRevokedValidator(trustedValidator, client, ocspServiceProvider);
+        final Response response = getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der"));
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(getMockClient(response), ocspServiceProvider);
+        try (MockedStatic<DateAndTime.DefaultClock> mockedClock = mockStatic(DateAndTime.DefaultClock.class)) {
+            mockDate("2021-09-18T00:16:25", mockedClock);
             assertThatExceptionOfType(UserCertificateRevokedException.class)
                 .isThrownBy(() ->
                     validator.validateCertificateNotRevoked(estEid2018Cert))
@@ -255,27 +250,42 @@ void whenOcspResponseUnknown_thenThrows() throws Exception {
     }
 
     @Test
-    void whenOcspResponseCANotTrusted_thenThrows() throws Exception {
+    void whenOcspResponseCACertNotTrusted_thenThrows() throws Exception {
+        final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
+            getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der"))
+        );
+        try (MockedStatic<DateAndTime.DefaultClock> mockedClock = mockStatic(DateAndTime.DefaultClock.class)) {
+            mockDate("2021-09-18T00:16:25", mockedClock);
+            assertThatExceptionOfType(CertificateNotTrustedException.class)
+                .isThrownBy(() ->
+                    validator.validateCertificateNotRevoked(estEid2018Cert))
+                .withMessage("Certificate EMAILADDRESS=pki@sk.ee, CN=TEST of SK OCSP RESPONDER 2020, OU=OCSP, O=AS Sertifitseerimiskeskus, C=EE is not trusted");
+        }
+    }
+
+    @Test
+    void whenOcspResponseCACertExpired_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(getOcspResponseBytesFromResources("ocsp_response_unknown.der"), OCSP_RESPONSE))
-                .build());
-        assertThatExceptionOfType(CertificateNotTrustedException.class)
+            getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der"))
+        );
+        assertThatExceptionOfType(CertificateExpiredException.class)
             .isThrownBy(() ->
                 validator.validateCertificateNotRevoked(estEid2018Cert))
-            .withMessage("Certificate EMAILADDRESS=pki@sk.ee, CN=TEST of SK OCSP RESPONDER 2020, OU=OCSP, O=AS Sertifitseerimiskeskus, C=EE is not trusted");
+            .withMessage("AIA OCSP responder certificate has expired");
     }
 
     @Test
     void whenNonceDiffers_thenThrows() throws Exception {
         final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp(
-            getResponseBuilder()
-                .body(ResponseBody.create(getOcspResponseBytesFromResources(), OCSP_RESPONSE))
-                .build());
-        assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
-            .isThrownBy(() ->
-                validator.validateCertificateNotRevoked(estEid2018Cert))
-            .withMessage("User certificate revocation check has failed: OCSP request and response nonces differ, possible replay attack");
+            getMockedResponse(getOcspResponseBytesFromResources())
+        );
+        try (MockedStatic<DateAndTime.DefaultClock> mockedClock = mockStatic(DateAndTime.DefaultClock.class)) {
+            mockDate("2021-09-17T18:25:24", mockedClock);
+            assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
+                .isThrownBy(() ->
+                    validator.validateCertificateNotRevoked(estEid2018Cert))
+                .withMessage("User certificate revocation check has failed: OCSP request and response nonces differ, possible replay attack");
+        }
     }
 
     private static byte[] buildOcspResponseBodyWithInternalErrorStatus() throws IOException {
@@ -326,15 +336,16 @@ private static byte[] getOcspResponseBytesFromResources(String resource) throws
         }
     }
 
-    @NotNull
     private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidatorWithAiaOcsp(Response response) throws JceException {
-        final OcspClient client = (url, request) -> new OCSPResp(Objects.requireNonNull(response.body()).bytes());
-        return getSubjectCertificateNotRevokedValidatorWithAiaOcsp(client);
+        return getSubjectCertificateNotRevokedValidator(getMockClient(response), getAiaOcspServiceProvider());
     }
 
-    @NotNull
-    private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidatorWithAiaOcsp(OcspClient client) throws JceException {
-        return new SubjectCertificateNotRevokedValidator(trustedValidator, client, getAiaOcspServiceProvider());
+    private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidator(OcspServiceProvider ocspServiceProvider) {
+        return getSubjectCertificateNotRevokedValidator(ocspClient, ocspServiceProvider);
+    }
+
+    private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidator(OcspClient client, OcspServiceProvider ocspServiceProvider) {
+        return new SubjectCertificateNotRevokedValidator(trustedValidator, client, ocspServiceProvider, CONFIGURATION.getAllowedOcspResponseTimeSkew(), CONFIGURATION.getMaxOcspResponseThisUpdateAge());
     }
 
     private static void setSubjectCertificateIssuerCertificate(SubjectCertificateTrustedValidator trustedValidator) throws NoSuchFieldException, IllegalAccessException, CertificateException, IOException {
@@ -343,13 +354,25 @@ private static void setSubjectCertificateIssuerCertificate(SubjectCertificateTru
         field.set(trustedValidator, getTestEsteid2018CA());
     }
 
-    @NotNull
-    private static Response.Builder getResponseBuilder() {
+    private Response getMockedResponse(byte[] bodyContent) {
+        final Request req = new Request.Builder()
+            .url("http://testing")
+            .build();
         return new Response.Builder()
-            .request(new Request.Builder().url("http://testing").build())
-            .message("testing")
+            .request(req)
             .protocol(Protocol.HTTP_1_1)
-            .code(200);
+            .code(200)
+            .message("OK")
+            .body(ResponseBody.create(bodyContent, MediaType.get("application/ocsp-response")))
+            .build();
+    }
+
+    private OcspClient getMockClient(Response response) {
+        return (url, request) -> {
+            try (final ResponseBody body = Objects.requireNonNull(response.body())) {
+                return new OCSPResp(body.bytes());
+            }
+        };
     }
 
     private static byte[] toByteArray(InputStream resourceAsStream) throws IOException {
diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java
index 102271aa..7059ff53 100644
--- a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java
+++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java
index 9afa7689..57dcfd10 100644
--- a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java
+++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,68 +22,101 @@
 
 package eu.webeid.security.validator.ocsp;
 
-import eu.webeid.security.testutil.Dates;
+import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
 import org.bouncycastle.cert.ocsp.SingleResp;
 import org.junit.jupiter.api.Test;
-import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
 
+import java.time.Duration;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.Date;
 
+import static eu.webeid.security.validator.AuthTokenValidatorBuilderTest.CONFIGURATION;
+import static eu.webeid.security.validator.ocsp.OcspResponseValidator.validateCertificateStatusUpdateTime;
+import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import static eu.webeid.security.validator.ocsp.OcspResponseValidator.validateCertificateStatusUpdateTime;
 
 class OcspResponseValidatorTest {
 
+    private static final Duration TIME_SKEW = CONFIGURATION.getAllowedOcspResponseTimeSkew();
+    private static final Duration THIS_UPDATE_AGE = CONFIGURATION.getMaxOcspResponseThisUpdateAge();
+
     @Test
-    void whenThisUpdateDayBeforeProducedAt_thenThrows() throws Exception {
+    void whenThisAndNextUpdateWithinSkew_thenValidationSucceeds() {
         final SingleResp mockResponse = mock(SingleResp.class);
-        // yyyy-MM-dd'T'HH:mm:ss.SSSZ
-        when(mockResponse.getThisUpdate()).thenReturn(Dates.create("2021-09-01T00:00:00.000Z"));
-        final Date producedAt = Dates.create("2021-09-02T00:00:00.000Z");
+        Instant now = Instant.now();
+        Date thisUpdateWithinAgeLimit = getThisUpdateWithinAgeLimit(now);
+        Date nextUpdateWithinAgeLimit = Date.from(now.minus(THIS_UPDATE_AGE.minusSeconds(2)));
+        when(mockResponse.getThisUpdate()).thenReturn(thisUpdateWithinAgeLimit);
+        when(mockResponse.getNextUpdate()).thenReturn(nextUpdateWithinAgeLimit);
+        assertThatCode(() -> validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE))
+            .doesNotThrowAnyException();
+    }
+
+    @Test
+    void whenNextUpdateBeforeThisUpdate_thenThrows() {
+        final SingleResp mockResponse = mock(SingleResp.class);
+        Instant now = Instant.now();
+        Date thisUpdateWithinAgeLimit = getThisUpdateWithinAgeLimit(now);
+        Date beforeThisUpdate = new Date(thisUpdateWithinAgeLimit.getTime() - 1000);
+        when(mockResponse.getThisUpdate()).thenReturn(thisUpdateWithinAgeLimit);
+        when(mockResponse.getNextUpdate()).thenReturn(beforeThisUpdate);
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
-                validateCertificateStatusUpdateTime(mockResponse, producedAt))
-            .withMessage("User certificate revocation check has failed: "
+                validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE))
+            .withMessageStartingWith("User certificate revocation check has failed: "
                 + "Certificate status update time check failed: "
-                + "notAllowedBefore: 2021-09-01 23:45:00 UTC, "
-                + "notAllowedAfter: 2021-09-02 00:15:00 UTC, "
-                + "thisUpdate: 2021-09-01 00:00:00 UTC, "
-                + "nextUpdate: null");
+                + "nextUpdate '" + beforeThisUpdate.toInstant() + "' is before thisUpdate '" + thisUpdateWithinAgeLimit.toInstant() + "'");
     }
 
     @Test
-    void whenThisUpdateDayAfterProducedAt_thenThrows() throws Exception {
+    void whenThisUpdateHalfHourBeforeNow_thenThrows() {
         final SingleResp mockResponse = mock(SingleResp.class);
-        when(mockResponse.getThisUpdate()).thenReturn(Dates.create("2021-09-02"));
-        final Date producedAt = Dates.create("2021-09-01");
+        Instant now = Instant.now();
+        Date halfHourBeforeNow = Date.from(now.minus(30, ChronoUnit.MINUTES));
+        when(mockResponse.getThisUpdate()).thenReturn(halfHourBeforeNow);
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
-                validateCertificateStatusUpdateTime(mockResponse, producedAt))
-            .withMessage("User certificate revocation check has failed: "
+                validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE))
+            .withMessageStartingWith("User certificate revocation check has failed: "
+                + "Certificate status update time check failed: "
+                + "thisUpdate '" + halfHourBeforeNow.toInstant() + "' is too old, minimum time allowed: ");
+    }
+
+    @Test
+    void whenThisUpdateHalfHourAfterNow_thenThrows() {
+        final SingleResp mockResponse = mock(SingleResp.class);
+        Instant now = Instant.now();
+        Date halfHourAfterNow = Date.from(now.plus(30, ChronoUnit.MINUTES));
+        when(mockResponse.getThisUpdate()).thenReturn(halfHourAfterNow);
+        assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
+            .isThrownBy(() ->
+                validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE))
+            .withMessageStartingWith("User certificate revocation check has failed: "
                 + "Certificate status update time check failed: "
-                + "notAllowedBefore: 2021-08-31 23:45:00 UTC, "
-                + "notAllowedAfter: 2021-09-01 00:15:00 UTC, "
-                + "thisUpdate: 2021-09-02 00:00:00 UTC, "
-                + "nextUpdate: null");
+                + "thisUpdate '" + halfHourAfterNow.toInstant() + "' is too far in the future, latest allowed: ");
     }
 
     @Test
-    void whenNextUpdateDayBeforeProducedAt_thenThrows() throws Exception {
+    void whenNextUpdateHalfHourBeforeNow_thenThrows() {
         final SingleResp mockResponse = mock(SingleResp.class);
-        when(mockResponse.getThisUpdate()).thenReturn(Dates.create("2021-09-02"));
-        when(mockResponse.getNextUpdate()).thenReturn(Dates.create("2021-09-01"));
-        final Date producedAt = Dates.create("2021-09-02");
+        Instant now = Instant.now();
+        Date thisUpdateWithinAgeLimit = getThisUpdateWithinAgeLimit(now);
+        Date halfHourBeforeNow = Date.from(now.minus(30, ChronoUnit.MINUTES));
+        when(mockResponse.getThisUpdate()).thenReturn(thisUpdateWithinAgeLimit);
+        when(mockResponse.getNextUpdate()).thenReturn(halfHourBeforeNow);
         assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class)
             .isThrownBy(() ->
-                validateCertificateStatusUpdateTime(mockResponse, producedAt))
+                validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE))
             .withMessage("User certificate revocation check has failed: "
                 + "Certificate status update time check failed: "
-                + "notAllowedBefore: 2021-09-01 23:45:00 UTC, "
-                + "notAllowedAfter: 2021-09-02 00:15:00 UTC, "
-                + "thisUpdate: 2021-09-02 00:00:00 UTC, "
-                + "nextUpdate: 2021-09-01 00:00:00 UTC");
+                + "nextUpdate '" + halfHourBeforeNow.toInstant() + "' is in the past");
+    }
+
+    private static Date getThisUpdateWithinAgeLimit(Instant now) {
+        return Date.from(now.minus(THIS_UPDATE_AGE.minusSeconds(1)));
     }
 
 }
diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java
index 819c9df9..00337fd9 100644
--- a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java
+++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java
index 8bf2eea5..95b5759e 100644
--- a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java
+++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020-2023 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal