Letsencrypt Handling OCSP stapling cache on Nginx

This only happens when you issue and use SSL certificates with an optional/additional OCSP must staple extension flag. Normal SSL certificate issuance doesn't include the OCSP must staple extension flag. Centmin Mod doesn't at least in it's default Nginx HTTPS configurations due to as you said Nginx OCSP implementation is to serve OCSP responses on a per worker basis and the first request by visitor does not get a OCSP response immediately but is cached for subsequent response. So it takes a few visits to prime OCSP responses cache as each Nginx worker has its own cache.

Only way as Nginx can optionally support OCSP stapled response file which you need to programically create via a cronjob as the OCSP responses are usually only valid for specific period like 5 days or so.

If you know how to code, you could develop your own separate OCSP server to handle just the OCSP stapled response and prefetch it High-reliability OCSP stapling and why it matters

 

Note the differences too with OCSP must staple extension enabled in your SSL letsencrypt certificate.

• Nginx default native OCSP response cache method will cache subsequent OCSP requests eventually once all nginx workers have been cache primed. So only 1st visit won't have OCSP response
• Whereas if you do OCSP stapled file cache with cronjob, all requests even 1st request will get a OCSP stapled cached response. However, if the cronjob process fails to cache and/or OCSP staple cached, then all your requests subsequent + first will fail and you've effectively DOS attacked your own site as any browser visitor request will fail to load your site as browser would of been instructed by the OCSP must staple extension in your SSL cert to check for revocation/OCSP
• Also OCSP stapled file cached response does not support Nginx dual RSA + ECC SSL certificate support SSL - Nginx 1.11.0 introduces dual ECDSA + RSA SSL certificate support !. It can only support 1 SSL certificate and not multiple SSL certificates per domain name.

 

Thanks to @petecooper reminder, I've updated Centmin Mod 123.09beta01's Nginx builds to optionally allow patch overriding of Nginx's default OCSP response cache time which is 1hr (3600 seconds) to a custom value you can set yourself and on default override is set to 24hr (86400 seconds) cache time instead if you choose to enable it as per instructions at Beta Branch - add NGINX_STAPLE_CACHE_OVERRIDE option in 123.09beta01