diff --git a/include/mbedtls/asn1.h b/include/mbedtls/asn1.h
index e159e57ea0..0fc881166b 100644
--- a/include/mbedtls/asn1.h
+++ b/include/mbedtls/asn1.h
@@ -74,6 +74,7 @@
 #define MBEDTLS_ASN1_OCTET_STRING            0x04
 #define MBEDTLS_ASN1_NULL                    0x05
 #define MBEDTLS_ASN1_OID                     0x06
+#define MBEDTLS_ASN1_ENUMERATED              0x0A
 #define MBEDTLS_ASN1_UTF8_STRING             0x0C
 #define MBEDTLS_ASN1_SEQUENCE                0x10
 #define MBEDTLS_ASN1_SET                     0x11
diff --git a/include/mbedtls/x509_ocsp.h b/include/mbedtls/x509_ocsp.h
index bcaca48ea6..fbc1281d26 100644
--- a/include/mbedtls/x509_ocsp.h
+++ b/include/mbedtls/x509_ocsp.h
@@ -36,6 +36,16 @@
 
 #include <stdint.h>
 
+#define MBEDTLS_ERR_X509_OCSP_INVALID_RESPONSE_STATUS    -0x9010 /**< The OCSP response status is invalid */
+
+/* OCSP response status values as defined in RFC 6960 Section 4.2.1 */
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_SUCCESSFUL        0
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_MALFORMED_REQ     1
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_INTERNAL_ERR      2
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_TRY_LATER         3
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_SIG_REQUIRED      5
+#define MBEDTLS_X509_OCSP_RESPONSE_STATUS_UNAUTHORIZED      6
+
 /**
  * \addtogroup x509_module
  * \{
diff --git a/library/x509_ocsp.c b/library/x509_ocsp.c
index 0fea2d980e..4d58492034 100644
--- a/library/x509_ocsp.c
+++ b/library/x509_ocsp.c
@@ -56,6 +56,35 @@ static int x509_ocsp_get_response_status( unsigned char **p,
                                           const unsigned char *end,
                                           uint8_t *resp_status )
 {
+    int ret;
+    size_t len;
+
+    if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
+                                      MBEDTLS_ASN1_ENUMERATED ) ) != 0 )
+    {
+        return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
+    }
+
+    if( len != 1 )
+        return( MBEDTLS_ERR_X509_INVALID_FORMAT +
+                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+
+    *resp_status = *( *p )++;
+
+    /* Ensure the parsed response status is valid */
+    switch( *resp_status )
+    {
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_SUCCESSFUL:
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_MALFORMED_REQ:
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_INTERNAL_ERR:
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_TRY_LATER:
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_SIG_REQUIRED:
+        case MBEDTLS_X509_OCSP_RESPONSE_STATUS_UNAUTHORIZED:
+            break;
+        default:
+            return( MBEDTLS_ERR_X509_OCSP_INVALID_RESPONSE_STATUS );
+    }
+
     return( 0 );
 }