In #950, I add OCSP stapling in Nginx using its own fetcher. However, this is best-effort and fails to staple a response on the first request after startup.

Instead, we should use ssl_stapling_file, which allows us to prefetch an OCSP response for each certificate and store it in a file to be loaded by Nginx. This will increase reliability, which is very important since we would like to eventually be able to implement OCSP Must Staple.

The cron job that fetches the OCSP response should run about once an hour. Even though OCSP responses are currently only regenerated every three days, this ensures that if there is any downtime or slop, the server gets an updated version very soon after it is available.