OCSP stapling needs a resolver, or it silently does nothing

Stapling saves the client a round trip to the certificate authority and stops the CA learning which sites that user visits, and the configuration is inert without one extra line.

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

resolver 1.1.1.1 9.9.9.9 valid=300s;
resolver_timeout 5s;

# and the only way to know it worked:
# openssl s_client -connect example.com:443 -status | grep -A2 'OCSP Response'

nginx needs to resolve the responder’s hostname and has no resolver by default, so without that line stapling is configured and disabled at the same time — with no error anywhere. The first request after a reload is unstapled while nginx fetches a response, which is expected and briefly confusing when verifying. Checking with s_client -status is the only reliable confirmation; the configuration file tells you nothing about whether it is working.