The warning for OCSP signer certificate about to expire does not seem to be triggering correctly.

Debug log will show time not yet reached even if it is a later time:

Time for "certificate will soon expire" not yet reached. You will be warned after: Thu Oct 04 13:35:14 CEST 2018 

To reproduce:

1. Create OCSP keybinding
2. Create an OCSP signer certificate with short validity (warning should trigger 1 week before expiration by default) and install in OCSP keybinding
3. Send OCSP request
4. Check server log for warning. Debug log will say that time is not yet reached