nginx OCSP stapling centos let's encrypt

Question

On centos, but I guess for every OS, I want to make ocsp stapling work in Nginx

ssl_stapling on;
ssl_trusted_certificate  ??????; 
ssl_stapling_verify on;

what do I define for ssl_trusted_certificate? People talk about "chain+root file" or root.ca, but it's very unclear to me if these files are already on my server or where to find/create them.

I have a valid certificate from Let's Encrypt and SSL/TLS (https) is working fine already. But how do I go from here?

Answer 1

For anyone wondering...

ssl_stapling on;
ssl_trusted_certificate  /etc/letsencrypt/live/DOMAIN/chain.pem;
#ssl_stapling_verify on;

note the hash, by having no verify it actually works:

on the command line: openssl s_client -connect DOMAIN:443 -tls1 -tlsextdebug -status |grep OCSP -A 2 -B 1

OCSP response:
======================================
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3