To deploy the OCSP service in an Active-Active architecture:

1. Follow the steps described in Starting up PKI Hub to install and configure a Cryptographic Security Platform cluster in each data center. 
2. If an Entrust Certificate Authority provides the certificate status, follow the steps described in Managing CA Gateway to configure CA Gateway in both data centers,
   1. Synchronize the CA Gateway configuration between data centers as previously explained in Configuration synchronization. Note that the URLs may differ between data centers depending on the network topology.
   2. Deploy the CA Gateway solution in both data centers.
3. In both data centers, configure Validation Authority solutions as described in Managing Validation Authority.
   1. Configure the Hardware Security Module (HSM) in each data center. Typically, each data center has its own HSM cluster. If the latency between data centers is low, a single HSM cluster can be deployed across all data centers, and each PKI Hub cluster can be configured to use all the HSMs.
   2. Generate OCSP signing keys for each Validation Authority deployment. Each deployment uses its own OCSP signing keys, but the issuing CA can be the same.
   3. Synchronize the Validation Authority configuration between data centers as previously explained in Configuring synchronization. Configure each Validation Authority deployment to retrieve certificate revocation status from the same Entrust Certificate Authority or CRL server. Note that the URLs may differ between data centers depending on the network topology.
   4. Deploy Validation Authority solution in both data centers.
4. Configure the load balancer or DNS to distribute OCSP traffic across all active data centers.