Without stapling, a browser checking whether your certificate is revoked makes its own request to the CA — adding latency, and telling the CA which sites that user visits.
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 1.1.1.1 9.9.9.9 valid=300s;
resolver_timeout 5s;The resolver line is required and its absence is why stapling silently does nothing on most configurations — nginx needs to resolve the OCSP responder’s hostname and has no resolver by default. Verifying with openssl s_client -status is the only way to know it worked, because there is no error when it does not. The first request after a reload is unstapled while nginx fetches the response, which is expected and briefly confusing.