diff --git a/Changelog.md b/Changelog.md
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,3 +1,9 @@
+### 0.5.2.0
+
+- Use *getConstructedEndRepr* when the end of the sequence is required to be
+  collected.
+- Improve the implementation of *extEncode* for *ExtAuthorityInfoAccess*.
+
 ### 0.5.1.0
 
 - Hide the constructor of *CertId*.
diff --git a/Data/X509/AIA.hs b/Data/X509/AIA.hs
--- a/Data/X509/AIA.hs
+++ b/Data/X509/AIA.hs
@@ -65,6 +65,14 @@
 newtype ExtAuthorityInfoAccess = ExtAuthorityInfoAccess [AuthorityInfoAccess]
     deriving (Show, Eq)
 
+pattern Asn1ExtAIAOCSP :: ByteString -> ASN1S
+pattern Asn1ExtAIAOCSP location xs =
+    Start Sequence
+    : OID OidOCSP
+    : Other Context 6 location
+    : End Sequence
+    : xs
+
 data DecState = DecStart | DecMethod | DecLocation OID | DecEnd
 
 instance Extension ExtAuthorityInfoAccess where
@@ -72,18 +80,14 @@
     extHasNestedASN1 = const True
     extEncode (ExtAuthorityInfoAccess aia) =
         Start Sequence
-        : concatMap (\AuthorityInfoAccess {..} ->
-                        case aiaMethod of
-                            OCSP ->
-                                [ Start Sequence
-                                , OID $ getObjectID aiaMethod
-                                , Other Context 6 aiaLocation
-                                , End Sequence
-                                ]
-                            CAIssuers ->
-                                error "encoding CA Issuers is not implemented"
-                    ) aia
-        ++ [End Sequence]
+        : foldr (\AuthorityInfoAccess {..} encAia ->
+                    case aiaMethod of
+                        OCSP ->
+                            Asn1ExtAIAOCSP aiaLocation encAia
+                        CAIssuers ->
+                            error "extEncode: \
+                                  \encoding CA Issuers is not implemented"
+                ) [End Sequence] aia
     extDecode [Start Sequence, End Sequence] =
         Right $ ExtAuthorityInfoAccess []
     extDecode (Start Sequence : encAia) =
@@ -102,7 +106,7 @@
               go DecEnd [End Sequence, End Sequence] =
                   Right . ExtAuthorityInfoAccess . reverse
               go _ _ =
-                  const $ Left "bad AIA sequence"
+                  const $ Left "extDecode: bad AIA sequence"
     extDecode _ =
-        Left "bad AIA sequence"
+        Left "extDecode: bad AIA sequence"
 
diff --git a/Data/X509/OCSP.hs b/Data/X509/OCSP.hs
--- a/Data/X509/OCSP.hs
+++ b/Data/X509/OCSP.hs
@@ -1,5 +1,5 @@
 {-# LANGUAGE PatternSynonyms, ViewPatterns, TypeApplications, LambdaCase #-}
-{-# LANGUAGE ImportQualifiedPost #-}
+{-# LANGUAGE TupleSections, ImportQualifiedPost #-}
 
 -----------------------------------------------------------------------------
 -- |
@@ -50,6 +50,7 @@
 import Data.Bifunctor
 import Data.ByteArray qualified as BA
 import Crypto.Hash
+import Control.Monad
 
 pattern OidAlgorithmSHA1 :: OID
 pattern OidAlgorithmSHA1 = [1, 3, 14, 3, 2, 26]
@@ -108,7 +109,7 @@
                      : OID _
                      : (skipCurrentContainer -> v@BitString {} : _) ->
                          L.drop 1 $ encodeASN1 DER $ pure v
-                   _ -> error "bad pubkey sequence"
+                   _ -> error "pubKeyHash: bad pubkey sequence"
 {-# SPECIALIZE pubKeyHash :: Certificate -> Digest SHA1 #-}
 
 toCertId :: Certificate -> Certificate -> CertId
@@ -322,10 +323,10 @@
 getOCSPResponseVerificationData'
     :: [ASN1]                   -- ^ OCSP response payload
     -> Maybe OCSPResponseVerificationData
-getOCSPResponseVerificationData' (Start Sequence : Start Sequence : c1)
-    | (resp, c2) <- getConstructedEnd 0 c1
-    , Right (alg, BitString (BitArray _ sig) : c3) <- fromASN1 c2 = do
-        let der = encodeASN1' DER $ Start Sequence : resp ++ [End Sequence]
+getOCSPResponseVerificationData' (Start Sequence : c1@(Start Sequence : _))
+    | (join bimap $ map fst -> (encodeASN1' DER -> resp, c2)) <-
+        getConstructedEndRepr $ map (, []) c1
+    , Right (alg, BitString (BitArray _ sig) : c3) <- fromASN1 c2 =
         case c3 of
             [End Sequence] -> Just []
             _ | Start (Container Context 0)
@@ -334,7 +335,7 @@
                       getCurrentContainerContents c3 ->
                           reverse <$> collectCerts certs []
               | otherwise -> Nothing
-            >>= Just . OCSPResponseVerificationData der alg sig
+        >>= Just . OCSPResponseVerificationData resp alg sig
     where collectCerts (Start Sequence : c4) certs
               | (c5@(Start Sequence : c6), next) <- getConstructedEnd 0 c4
               , Right (cert, End Sequence : c7) <- fromASN1 c6
@@ -347,9 +348,9 @@
               Nothing
 getOCSPResponseVerificationData' _ = Nothing
 
-getCurrentContainerContents :: [ASN1] -> [ASN1]
+getCurrentContainerContents :: ASN1S
 getCurrentContainerContents = fst . getConstructedEnd 0
 
-skipCurrentContainer :: [ASN1] -> [ASN1]
+skipCurrentContainer :: ASN1S
 skipCurrentContainer = snd . getConstructedEnd 0
 
diff --git a/x509-ocsp.cabal b/x509-ocsp.cabal
--- a/x509-ocsp.cabal
+++ b/x509-ocsp.cabal
@@ -1,7 +1,7 @@
 cabal-version:          2.4
 
 name:                   x509-ocsp
-version:                0.5.1.0
+version:                0.5.2.0
 synopsis:               Basic X509 OCSP implementation
 description:            Build X509 OCSP requests and parse responses
 homepage:               https://github.com/lyokha/x509-ocsp