OCSP Request failed with following message

You are correct. And although I am biased, I will echo your recommendation to use Caddy. :slight_smile: Its OCSP stapling implementation is more robust than that of nginx and Apache.

  • Caddy updates the staple halfway through its validity period.
  • Updates happen in the background, not during requests.
  • Staples are only accepted if they are actually valid, including edge cases we’ve seen where the staple might expire after the certificate.
  • Caddy staples OCSP to all qualifying certificates by default.
  • OCSP staples are cached to disk so it can weather outages that are several days long, usually plenty long enough to gain connectivity to one of the responders.

When major OCSP outages happened a few months ago that even took down gnu.org and many other sites in Firefox and other clients that enforce revocation checking, Caddy sites stayed afloat.