Have you tried --staple-ocsp? I think you generally need to specify the --must-staple part on first creating the certificate and it won't have an effect for renewals. See also: Certbot enhance --must-staple - #3 by Xan
2 Likes