Run your own resolver locally, with DNSSEC enabled.
Assuming the RRs for the domains you are querying are signed, that's (IMO) probably all you need to do. While OCSP happens over plain-text HTTP, the responses are also signed so that you can verify them.
If the CA isn't using DNSSEC for their zones (or, specifically, the RRs for the hosts listed in the URIs in the signed certificates), I don't think there's much more you can really do (as the DNS queries/responses will travel over the Internet "in the clear" -- and, thus, subject to tampering/modification).
Or am I missing some part of your process that could potentially be compromised that you're trying to protect against?
Also, an attacker could block your HTTP requests (for CRL downloads/OCSP queries). How does your application react when it doesn't get a response? "Fail open" or "fail closed"?
Assuming the RRs for the domains you are querying are signed, that's (IMO) probably all you need to do. While OCSP happens over plain-text HTTP, the responses are also signed so that you can verify them.
If the CA isn't using DNSSEC for their zones (or, specifically, the RRs for the hosts listed in the URIs in the signed certificates), I don't think there's much more you can really do (as the DNS queries/responses will travel over the Internet "in the clear" -- and, thus, subject to tampering/modification).
Or am I missing some part of your process that could potentially be compromised that you're trying to protect against?
Also, an attacker could block your HTTP requests (for CRL downloads/OCSP queries). How does your application react when it doesn't get a response? "Fail open" or "fail closed"?