SEC_ERROR_OCSP_OLD_RESPONSE

• OCSP response carries thisUpdate + nextUpdate timestamps (usually 7 days)
• nginx: ssl_stapling on + ssl_stapling_verify on + resolver 1.1.1.1 valid=300s
• Check: echo | openssl s_client -connect host:443 -status 2>/dev/null | grep -A10 "OCSP response"
• Must-Staple extension requires stapling — without it the browser refuses the connection
• Firefox re-checks every 24 h if the response is becoming stale

# Verify OCSP stapling works
$ echo | openssl s_client -connect host:443 -status 2>/dev/null | \
    grep -E "OCSP response|thisUpdate|nextUpdate"

# nginx config
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 valid=300s;
resolver_timeout 5s;

# Force refresh OCSP cache — restart
$ systemctl reload nginx

• Setup OCSP stapling
• Must-Staple missing