PKIXRevocationChecker does not use OCSP Responder URL set in Certificate

I am trying to perform certificate validation with JAVA's CertPathValidator, but am having difficulty with the revocation validation.

The certificate I am trying to validate has the OCSP URL encoded within it, but for some reason PKIXRevocationChecker does not load this URL.

I took a look at how the PKIXRevocationChecker is initialized and found that it will only check from Security.getProperty("ocsp.responderURL") if one has not been manually configured.

Is this the intended behavior of the library? I would think that the library should automatically use the OCSP responder URL if it is provided in the certificate being validated.

From the spec (https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html):

By default, the location of the OCSP responder is determined implicitly from the certificate being validated. The property is used when the Authority Information Access extension (defined in RFC 5280) is absent from the certificate or when it requires overriding.

Read deeper into this spec, and found this matrix:

So, PKIXParameters has a revocationEnabled property that is set to true by default, but there is also an ocsp.enable property that is set to false by default. This configuration will only cause CRL revocation to occur.

Setting ocsp.enable to true via: Security.setProperty("ocsp.enable", "true"); fixed the issue.