From c323507de422cde7c52815b8bd5f9f880a723618 Mon Sep 17 00:00:00 2001 From: lingkai5wu Date: Mon, 12 Oct 2026 13:20:42 +0800 Subject: [PATCH] chore: disable OCSP stapling (origin cert lacks OCSP URI) The origin certificate does not include an OCSP responder URL, causing nginx warnings. Comment out stapling directives until a proper certificate with OCSP support is deployed. --- conf.d/10-defaults.conf.template | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/conf.d/10-defaults.conf.template b/conf.d/10-defaults.conf.template index 60c3868..def6e30 100644 --- a/conf.d/10-defaults.conf.template +++ b/conf.d/10-defaults.conf.template @@ -4,10 +4,12 @@ ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; ssl_session_tickets off; -ssl_stapling on; -ssl_stapling_verify on; -resolver 1.1.1.1 8.8.8.8 valid=300s; -resolver_timeout 5s; +# OCSP stapling requires certificates with an OCSP responder URL. +# Uncomment when the origin certificate supports it. +# ssl_stapling on; +# ssl_stapling_verify on; +# resolver 1.1.1.1 8.8.8.8 valid=300s; +# resolver_timeout 5s; server { listen 80 default_server;