nginx and the resolver that stapling needs

OCSP stapling saves the client a round trip to the certificate authority, and the configuration is completely inert without one extra line that nothing warns about.

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

resolver 1.1.1.1 9.9.9.9 valid=300s;
resolver_timeout 5s;

# openssl s_client -connect example.com:443 -status | grep -A2 'OCSP'

nginx needs to resolve the responder’s hostname and has no resolver by default, so without that line stapling is configured and disabled at the same time — with no error anywhere. The first request after a reload is unstapled while nginx fetches a response, which is expected and briefly confusing when verifying. The configuration file tells you nothing about whether it is working; only s_client -status does.