Without stapling, the browser checks whether a certificate has been revoked by contacting the issuing authority itself — an extra DNS lookup and request, to a third party, before the page can start loading.
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/shop.example.com/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;The server fetches the signed response periodically and includes it in the handshake, so the client needs no extra connection. The resolver line is not optional and is the usual reason stapling silently does not work — nginx needs a DNS server to reach the OCSP responder, and without one it fails quietly rather than erroring. Verify with openssl s_client -status; a missing staple prints nothing at all rather than a warning.