Allow dedicated Redis for OCSP publication

README.md

@@ -193,9 +193,10 @@ only as SHA-256 digests, and cannot mint/revoke tokens.
 
 ## OCSP responder
 
-KCA publishes full per-CA certificate-status snapshots to the same Redis
-instance and logical database used for sessions, and ships a standalone
-Rust/Axum responder on port `2560`.
+KCA publishes full per-CA certificate-status snapshots to Redis and ships a
+standalone Rust/Axum responder on port `2560`. By default, snapshots use the
+same Redis instance and logical database as sessions; setting
+`KCA_OCSP_REDIS_URL` selects a dedicated OCSP instance instead.
 
 - KCA publishes `ocsp:<KCA CA UUID>` whenever certificates are issued, renewed,
   revoked, deleted or imported. Revocation reasons are included; this is a full
@@ -217,16 +218,17 @@ Rust/Axum responder on port `2560`.
   `release/*` tags as the server image. The responder image is a statically
   linked musl executable running `FROM scratch` with only the CA bundle.
 
-Configure `REDIS_URL` and the other `KCA_OCSP_*` variables in
-`server/.env.example`. Run the responder with a configuration derived from
-`ocsp-responder/responder.example.yaml`, setting each issuer's `ca_id` to its
-CA certificate UUID in KCA and using the same Redis URL, or with Compose:
+Configure `REDIS_URL`, optional `KCA_OCSP_REDIS_URL`, and the other
+`KCA_OCSP_*` variables in `server/.env.example`. Run the responder with a
+configuration derived from `ocsp-responder/responder.example.yaml`, setting
+each issuer's `ca_id` to its CA certificate UUID in KCA and using the OCSP
+Redis URL, or with Compose:
 
 ```sh
 docker compose --profile ocsp up --build
 ```
 
-See `ocsp-responder/README.md` for the JSON layout, signer requirements and
+See `ocsp-responder/README.md` for the CBOR layout, signer requirements and
 `openssl ocsp` verification.
 
 ## REST API