Note: for nginx there is https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_crl https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_... which n

Note: for nginx there is https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_crl https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_... which needs to be pointed to a pem-encoded file with the CRL list (list of revoked certs). So no API-based configuration, like OCSP stapling, that just works. I can probably try to configure this with a cronjob/systemd timer but this is significantly less ergonomic.