Certbot Nginx OSCP 的正确打开方式是什么

[lymanbernadette6]

如题，使用 certbot 申请的`*.a.com`证书，

``` conf

ssl_certificate /etc/letsencrypt/live/xxx/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xxx/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/xxx/chain.pem;

ssl_session_timeout 5m;
ssl_session_cache shared:MozSSL:10m;
ssl_dhparam /etc/ssl/dhparam.pem;
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

ssl_stapling on;
ssl_stapling_verify on;


client_max_body_size 0;
```
这个配置用了很久都没问题， 最近 reload 的时候就会出现:
```
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/letsencrypt/live/xxxx/fullchain.pem"
```
翻了一堆 issue 没有看到有什么解决方法，V 站大佬多，请问这个如何解决呢？

[lymanbernadette6]

似乎与这个有关：
https://letsencrypt.org/2024/12/05/ending-ocsp/

[geniusy]

zerossl 没问题