OCSP Stapling in Nginx is behaving strangely, how to deal with it?

Question

linux

I set up OCSP Stapling in nginx, but it doesn't work until I do sudo nginx -s reload
nginx itself starts as a service in systemd, but neither sudo systemctl restart nginx, nor reboot helps to make it work, only reload
uname -a

Linux kubog.ru 4.4.1-2-ARCH #1 SMP PREEMPT Wed Feb 3 13:12:33 UTC 2016 x86_64 GNU/Linux

nginx -V

nginx version: nginx/1.9.10
built with OpenSSL 1.0.2e 3 Dec 2015 (running with OpenSSL 1.0.2f  28 Jan 2016)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --sbin-path=/usr/bin/nginx --pid-path=/run/nginx.pid --lock-path=/run/lock/nginx.lock --user=http --group=http --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/client-body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-ipv6 --with-pcre-jit --with-file-aio --with-http_gunzip_module --with-http_gzip_static_module --with-http_realip_module --with-http_v2_module --with-http_ssl_module --with-http_stub_status_module --with-http_addition_module --with-http_degradation_module --with-http_mp4_module --with-http_secure_link_module --with-http_sub_module --with-threads --with-stream --with-stream_ssl_module --with-cc-opt='-pipe -fomit-frame-pointer -march=native -mtune=native' --add-module=../nginx-length-hiding-filter-module --add-module=../ngx_cache_purge

Piece of config

listen 443 ssl http2 default_server;
  ssl on;
  ssl_certificate /etc/nginx/ssl/kubog/kubog.crt;
  ssl_certificate_key /etc/nginx/ssl/kubog/kubog.key;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !kECDH !DSS !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';
  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/nginx/ssl/kubog/dh.pem;
  ssl_session_cache shared:KUBOGSSL:16m;
  ssl_session_timeout 60m;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/nginx/ssl/kubog/fullchain.pem;
  resolver 8.8.8.8 valid=300s;
  resolver_timeout 5s;
  server_tokens off;
  add_header Strict-Transport-Security "max-age=15552000";

in fullchain.pem I first have intermediate, then root certificates, in kubog.crt I have my certificate plus intermediate. The rest seems to be clear
. I don’t understand what’s going on at all. help me please

Answer 1

Doesn't address your question, but very close. On Ubuntu from 1.9.10, I noticed the following, service nginx start/stop/restart/reload do not work adequately or do not work at all. You have to manually do /etc/init.d/nginx restart/reload. The 1.9.x branch is not stable, so in principle this is normal.