add resolver with google DNS, see:

    https://scotthelme.co.uk/ocsp-stapling-speeding-up-ssl/

diff --git a/etc/nginx/conf.d/default.conf b/etc/nginx/conf.d/default.conf
index 4aef52526379ee316f76641ccfde19ea42e88145..a04c9c2ffa39b90e935a6c80f5d0dd9ef6745f09 100644 (file)
--- a/etc/nginx/conf.d/default.conf
+++ b/etc/nginx/conf.d/default.conf
@@ -22,6 +22,8 @@ server {
   ssl_stapling on;
   ssl_stapling_verify on;
   ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
+  resolver 8.8.8.8 8.8.4.4 valid=300s;
+  resolver_timeout 10s;
   # ssl_protocols TLSv1 TLSv1.1; # support legacy browsers
   # ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";