err: OCSP response contains bad number of responses

func ParseResponses(bytes []byte, issuer *x509.Certificate) ([]*Response, error) {
	return ParseResponsesForCert(bytes, nil, issuer)
}

func ParseResponsesForCert(bytes []byte, cert, issuer *x509.Certificate) ([]*Response, error) {
	var resp responseASN1
	rest, err := asn1.Unmarshal(bytes, &resp)
	if err != nil {
		return nil, err
	}
	if len(rest) > 0 {
		return nil, ParseError("trailing data in OCSP response")
	}

	if status := ResponseStatus(resp.Status); status != Success {
		return nil, ResponseError{status}
	}

	if !resp.Response.ResponseType.Equal(idPKIXOCSPBasic) {
		return nil, ParseError("bad OCSP response type")
	}

	var basicResp basicResponse
	rest, err = asn1.Unmarshal(resp.Response.Response, &basicResp)
	if err != nil {
		return nil, err
	}
	if len(rest) > 0 {
		return nil, ParseError("trailing data in OCSP response")
	}

	numResponses := len(basicResp.TBSResponseData.Responses)
	var responses []*Response

	for responseIndex := 0; responseIndex < numResponses; responseIndex++ {
		var singleResp singleResponse
		if cert == nil {
			singleResp = basicResp.TBSResponseData.Responses[responseIndex]
		} else {
			match := false
			for _, resp := range basicResp.TBSResponseData.Responses {
				if cert.SerialNumber.Cmp(resp.CertID.SerialNumber) == 0 {
					singleResp = resp
					match = true
					break
				}
			}
			if !match {
				return nil, ParseError("no response matching the supplied certificate")
			}
		}

		ret := &Response{
			TBSResponseData:    basicResp.TBSResponseData.Raw,
			Signature:          basicResp.Signature.RightAlign(),
			SignatureAlgorithm: getSignatureAlgorithmFromOID(basicResp.SignatureAlgorithm.Algorithm),
			Extensions:         singleResp.SingleExtensions,
			SerialNumber:       singleResp.CertID.SerialNumber,
			ProducedAt:         basicResp.TBSResponseData.ProducedAt,
			ThisUpdate:         singleResp.ThisUpdate,
			NextUpdate:         singleResp.NextUpdate,
		}

		// Handle the ResponderID CHOICE tag. ResponderID can be flattened into
		// TBSResponseData once https://go-review.googlesource.com/34503 has been
		// released.
		rawResponderID := basicResp.TBSResponseData.RawResponderID
		switch rawResponderID.Tag {
		case 1: // Name
			var rdn pkix.RDNSequence
			if rest, err := asn1.Unmarshal(rawResponderID.Bytes, &rdn); err != nil || len(rest) != 0 {
				return nil, ParseError("invalid responder name")
			}
			ret.RawResponderName = rawResponderID.Bytes
		case 2: // KeyHash
			if rest, err := asn1.Unmarshal(rawResponderID.Bytes, &ret.ResponderKeyHash); err != nil || len(rest) != 0 {
				return nil, ParseError("invalid responder key hash")
			}
		default:
			return nil, ParseError("invalid responder id tag")
		}

		if len(basicResp.Certificates) > 0 {
			// Responders should only send a single certificate (if they
			// send any) that connects the responder's certificate to the
			// original issuer. We accept responses with multiple
			// certificates due to a number responders sending them[1], but
			// ignore all but the first.
			//
			// [1] https://github.com/golang/go/issues/21527
			ret.Certificate, err = x509.ParseCertificate(basicResp.Certificates[0].FullBytes)
			if err != nil {
				return nil, err
			}

			if err := ret.CheckSignatureFrom(ret.Certificate); err != nil {
				return nil, ParseError("bad signature on embedded certificate: " + err.Error())
			}

			if issuer != nil {
				if err := issuer.CheckSignature(ret.Certificate.SignatureAlgorithm, ret.Certificate.RawTBSCertificate, ret.Certificate.Signature); err != nil {
					return nil, ParseError("bad OCSP signature: " + err.Error())
				}
			}
		} else if issuer != nil {
			if err := ret.CheckSignatureFrom(issuer); err != nil {
				return nil, ParseError("bad OCSP signature: " + err.Error())
			}
		}

		for _, ext := range singleResp.SingleExtensions {
			if ext.Critical {
				return nil, ParseError("unsupported critical extension")
			}
		}

		for h, oid := range hashOIDs {
			if singleResp.CertID.HashAlgorithm.Algorithm.Equal(oid) {
				ret.IssuerHash = h
				break
			}
		}
		if ret.IssuerHash == 0 {
			return nil, ParseError("unsupported issuer hash algorithm")
		}

		switch {
		case bool(singleResp.Good):
			ret.Status = Good
		case bool(singleResp.Unknown):
			ret.Status = Unknown
		default:
			ret.Status = Revoked
			ret.RevokedAt = singleResp.Revoked.RevocationTime
			ret.RevocationReason = int(singleResp.Revoked.Reason)
		}

		responses = append(responses, ret)
	}

	return responses, nil
}