implement OCSP stapling

can verify stapling using openssl s_client -connect hostname:443 -status

status_request is RFC6066. there is also status_request_v2 (RFC6961) but this is
not implemented even in openssl libs yet

src/nginxconfig.ejs

@@ -84,6 +84,12 @@ server {
     ssl_dhparam /home/yellowtent/boxdata/dhparams.pem;
     add_header Strict-Transport-Security "max-age=63072000";
 
+    <% if ( ocsp ) { -%>
+    # OCSP. LE certs are generated with must-staple flag so clients can enforce OCSP
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    <% } %>
+
     # https://github.com/twitter/secureheaders
     # https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Compatibility_Matrix
     # https://wiki.mozilla.org/Security/Guidelines/Web_Security