OCSP stapling has your server fetch and cache a signed revocation status from the CA periodically, then include ("staple") it directly in the TLS handshake — so visiting browsers don't need to make their own separate OCSP request to the CA.
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/fullchain.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;The ssl_trusted_certificate directive needs your full chain (certificate plus intermediates) for Nginx to correctly verify and staple the OCSP response. A working DNS resolver directive is required since Nginx needs to look up the OCSP responder's address to fetch the staple.
Verifying it's working
openssl s_client -connect yourdomain.com:443 -statusLook for "OCSP Response Status: successful" in the output — confirming your server is actually stapling a valid response, rather than just having the directive present but non-functional.
What to do if stapling shows as configured but isn't actually working
Confirming with `openssl s_client -connect yourdomain.com:443 -status` that a stapled OCSP response is actually being returned, rather than assuming the configuration directive alone guarantees it's working, catches cases where a missing resolver directive or firewall rule silently prevents stapling from functioning.
How Nginx's resolver directive specifically enables OCSP stapling to function
Nginx needs an explicitly configured DNS resolver directive to look up the OCSP responder's address at runtime — without it, stapling can silently fail even with the ssl_stapling directive correctly enabled, since Nginx has no way to actually reach the OCSP responder to fetch the status it needs to staple.
What ssl_trusted_certificate specifically needs to point to for stapling to work correctly
The ssl_trusted_certificate directive needs to reference your CA's intermediate and root certificate chain specifically, separate from your own certificate and key files, since Nginx uses this to verify the OCSP response it receives before stapling it into the handshake.
How to confirm stapling is providing a genuine performance benefit for your specific traffic pattern
Comparing handshake timing with stapling enabled versus disabled, using browser DevTools' detailed timing breakdown, shows the actual measured difference for your specific server and typical visitor latency — the benefit is generally more noticeable for visitors on higher-latency connections than for very fast, low-latency ones.
Why some Nginx versions require additional configuration for stapling to function correctly
Older Nginx versions had less complete or slightly different stapling implementation details than current versions — checking your specific Nginx version against current official documentation, particularly around the resolver and trusted certificate directives, avoids following outdated guidance that may not match your installed version's exact requirements.
What to do if Nginx logs show resolver-related errors related to stapling
A resolver-related error in Nginx's logs specifically points to the resolver directive being missing, misconfigured, or pointing to a DNS server Nginx can't actually reach — confirming the resolver address is correct and reachable from your server resolves this specific class of stapling error.
How to test stapling is working using a method other than OpenSSL directly
Several online SSL scan tools explicitly report OCSP stapling status as part of their standard test, providing a visual, browser-based alternative to interpreting raw OpenSSL command output for anyone less comfortable with the command line.
A closing note on stapling as one piece of a broader TLS hardening checklist
OCSP stapling is best understood as one specific item within a broader TLS hardening checklist, alongside strong cipher suites, HSTS, and a complete certificate chain — individually modest, but part of what collectively distinguishes a genuinely well-configured server from a merely functional one.
A final practical tip for catching a future regression
Once stapling is confirmed working, periodically re-verifying it after any Nginx upgrade or major configuration change catches a regression early, since a configuration change elsewhere can sometimes inadvertently affect stapling without an obvious, immediately visible symptom.