OCSP staling in NGINX via Plesk. How to?

In nginx (and to be fair, in other popular servers too) the stapling support is a bit, well I’d call it half-arsed.

When nginx first spins up a web server process, it doesn’t have the stapled OCSP response to hand, so by default it just doesn’t provide it. This can result in some tools saying there’s no OCSP stapling, because when they tried, there wasn’t. If you want you could try, ignore the result, wait a few minutes, then try again and see if it’s better?

Anyway, probably if SSL Labs says it’s working, it’s working as well as can be in nginx for now. Hopefully as stapling gets more popular we’ll see nginx getting a bit better at this.

Now, the chain issues are more surprising. The fullchain.pem prepared by Let’s Encrypt is usually perfectly good and wouldn’t attract a complaint from Qualys’ tools. The SSL Labs page does give a bit more info but I appreciate it can be hard to interpret, maybe you could paste the part where it lists certificates it saw ? If you worry particularly you could blur out your own site’s name anywhere that appears although please do remember certificates are public documents, they’re not secrets, and it’s not as though asking for advice about security is a shameful thing to be doing.