diff --git a/Changelog.md b/Changelog.md
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,9 +1,16 @@
+### 0.4.0.1
+
+- Ensure that the list of certificates in the OCSP response comprises the
+  correct ASN.1 sequence.
+- Refactor function *getOCSPResponseVerificationData'*.
+
 ### 0.4.0.0
 
 - Field *ocspRespCerts* of *OCSPResponseVerificationData* now contains a list
-  of *signed certificates* augmented by *DER*-encoded *tbsCertificate* as defined
-  in *rfc5280*. This enables check of the OCSP Signature Authority Delegation.
-  See a basic implementation of the check in the *client-ocsp* example.
+  of *signed certificates* augmented by *DER*-encoded *tbsCertificate* as
+  defined in *rfc5280*. This enables check of the OCSP Signature Authority
+  Delegation. See a basic implementation of the check in the *client-ocsp*
+  example.
 
 ### 0.3.1.0
 
diff --git a/Data/X509/OCSP.hs b/Data/X509/OCSP.hs
--- a/Data/X509/OCSP.hs
+++ b/Data/X509/OCSP.hs
@@ -292,7 +292,7 @@
         , ocspRespSignature :: ByteString
           -- ^ Signature
         , ocspRespCerts :: [(Signed Certificate, ByteString)]
-          -- ^ List of signed certificates
+          -- ^ List of signed certificates with DER-encoded certificate data
         } deriving (Show, Eq)
 
 -- | Get verification data from OCSP response.
@@ -313,43 +313,31 @@
 getOCSPResponseVerificationData'
     :: [ASN1]                   -- ^ OCSP response payload
     -> Maybe OCSPResponseVerificationData
-getOCSPResponseVerificationData' (Start Sequence : Start Sequence : c1) = do
-    let (wrapInSequence -> resp'', next) = getConstructedEnd 0 c1
-        der = encodeASN1' DER resp''
-    case next of
-        Start Sequence : c2 -> do
-            let (wrapInSequence -> alg, next') = getConstructedEnd 0 c2
-            (alg', []) <- fromASN1' alg
-            case next' of
-                BitString (BitArray _ sig) : c3
-                    | c3 == [End Sequence] ->
-                        Just $ OCSPResponseVerificationData
-                            der alg' sig []
-                    | Start (Container Context 0)
-                        : Start Sequence
-                        : certs <- getCurrentContainerContents c3 -> do
-                            certs' <- reverse <$> collectCerts certs []
-                            Just $ OCSPResponseVerificationData
-                                der alg' sig certs'
-                _ -> Nothing
-        _ -> Nothing
+getOCSPResponseVerificationData' (Start Sequence : Start Sequence : c1)
+    | (resp, Start Sequence : c2) <- getConstructedEnd 0 c1
+    , (alg, BitString (BitArray _ sig) : c3) <- getConstructedEnd 0 c2 = do
+        (alg', []) <- fromASN1' $ wrapInSequence alg
+        let der = encodeASN1' DER $ wrapInSequence resp
+        case c3 of
+            [End Sequence] -> Just []
+            _ | Start (Container Context 0)
+                  : Start Sequence
+                  : certs@(Start Sequence : _) <-
+                      getCurrentContainerContents c3 ->
+                          reverse <$> collectCerts certs []
+              | otherwise -> Nothing
+            >>= Just . OCSPResponseVerificationData der alg' sig
     where collectCerts (Start Sequence : c4) certs
-              | (Start Sequence : cert, c5) <- getConstructedEnd 0 c4 = do
-                    let (cert', next) = getConstructedEnd 0 cert
-                    case next of
-                        Start Sequence : cc1 -> do
-                            let (wrapInSequence -> alg, next') =
-                                    getConstructedEnd 0 cc1
-                            (alg', []) <- fromASN1' alg
-                            case next' of
-                                [BitString (BitArray _ sig)] -> do
-                                    (cert'', []) <- fromASN1' cert'
-                                    collectCerts c5 $
-                                        ( Signed cert'' alg' sig
-                                        , encodeASN1' DER $ wrapInSequence cert'
-                                        ) : certs
-                                _ -> Nothing
-                        _ -> Nothing
+              | (Start Sequence : cert, c5) <- getConstructedEnd 0 c4
+              , (cert', Start Sequence : c6) <- getConstructedEnd 0 cert
+              , (alg, [BitString (BitArray _ sig)]) <-
+                  getConstructedEnd 0 c6 = do
+                      (alg', []) <- fromASN1' $ wrapInSequence alg
+                      (cert'', []) <- fromASN1' cert'
+                      collectCerts c5 $
+                          ( Signed cert'' alg' sig
+                          , encodeASN1' DER $ wrapInSequence cert'
+                          ) : certs
           collectCerts [End Sequence, End (Container Context 0)] certs =
               Just certs
           collectCerts _ _ =
diff --git a/x509-ocsp.cabal b/x509-ocsp.cabal
--- a/x509-ocsp.cabal
+++ b/x509-ocsp.cabal
@@ -1,7 +1,7 @@
 cabal-version:          2.4
 
 name:                   x509-ocsp
-version:                0.4.0.0
+version:                0.4.0.1
 synopsis:               Basic X509 OCSP implementation
 description:            Build X509 OCSP requests and parse responses
 homepage:               https://github.com/lyokha/x509-ocsp