What exactly must be true for OCSP stapling to actually serve a stapled response on the first request?

What exactly must be true for OCSP stapling to actually serve a stapled response on the first request?

OCSP (Online Certificate Status Protocol, RFC 6960) stapling lets your server attach a fresh signed revocation status, sparing the client a third-party round trip. The common failure: it silently serves nothing for the first minutes after a reload. Checklist to make it deterministic.

— Provide the full issuer chain in ssl_certificate; nginx needs the issuer cert to locate and verify the OCSP responder's signature.
— Set ssl_stapling on; and ssl_stapling_verify on; together. Verify-off staples unvalidated responses, defeating the point.
— Pin a resolver with resolver 1.1.1.1 valid=300s;; without it nginx cannot resolve the responder hostname and stapling stays empty.
— Pre-warm by fetching the responder yourself with openssl ocsp so the response is cached before real traffic arrives.
— Validate from outside: openssl s_client -connect host:443 -status and confirm 'OCSP Response Status: successful'.

Known limitation: nginx fetches lazily on the first matching handshake, so the very first client gets no staple. A cron-triggered self-request closes that window.

Further reading: RFC 6960 section 4; nginx ngx_http_ssl_module docs.

Bottom line: stapling is not on until -status returns a verified response, not when the directive is set.