Enable OCSP stapling

See Security Certificate Revocation Awareness: The case for “OCSP Must-Staple” for background.

On Nginx at least, this is simply adding a couple of lines to the site config:

ssl_stapling on;
ssl_stapling_verify on;