Currently the CA and OCSP subsystems have their own OCSP signing certificates. Also, all PKI subsystem have their own audit signing certificates. So potentially there are seven different OCSP and audit signing certificates in the whole system. Each certificate has a unique nickname defined in /etc/pki/default.cfg:

[CA]
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s CA

[KRA]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s KRA

[OCSP]
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s OCSP
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s OCSP

[TKS]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TKS

[TPS]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TPS

While all of these certificates might be required in large deployments, it might be excessive in smaller deployments. For basic installations the admin might prefer to reuse the same OCSP and audit signing certificates for the whole system for simplicity. Also, OCSP load balancing probably requires reusing the same certificate in all OCSP instances as well.

In ticket #2280 there's already a plan to provide a mechanism to reuse existing system certificates if they already exist. Once that mechanism is implemented, the default.cfg can be changed to use the same nicknames for all subsystems:

[CA]
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s

[KRA]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s

[OCSP]
pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s

[TKS]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s

[TPS]
pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s

With this mechanism by default it will reuse the same OCSP and audit signing certificates, but the admin will still have the flexibility to use different certificates for each subsystem if needed.