OCSP for Private CA

OCSP-stapling is the correct approach for better performance and efficiency since it overcomes the limitation of frequent certificate status calls by the client to OCSP endpoints. If you want to utilize OCSP without having a CRL as a backup, consider using the OCSP must-staple certificate extension. You can use OCSP Must-Staple as a flag for the client to break the TLS connection if the certificate status returned is invalid. This will reduce the application availability risk as well by failing the TLS connection when the certificate cannot be validated. You should also note that this is only supported on TLS 1.2 or higher.

To accomplish OCSP stapling this can be done with Amazon CloudFront. When the client requests the server certificate to establish a TLS connection, the server will query the OCSP endpoint through CloudFront where the OCSP response is cached. By doing this the client no longer has to handle certificate validation, which will improve your performance.

https://aws.amazon.com/blogs/security/choosing-the-right-certificate-revocation-method-in-acm-private-ca/

https://aws.amazon.com/blogs/aws/cloudfront-ssl-ciphers-session-ocsp-pfs/