Nginx lets us use multiple certificates so that we can use both ECC and RSA certificates
ssl_certificate /etc/ssl/example.com.combined.crt; ssl_certificate_key /etc/ssl/example.com.key; ssl_certificate /etc/ssl/example.com-ecc.combined.crt; ssl_certificate_key /etc/ssl/example.com-ecc.key;
However, it only lets us specify a single trusted certificate to use for OCSP stapling:
Clearly we need to give it both chains of intermediate & root certs, but I can't find any documentation on whether it's supported at all, or what order these certs should be in, i.e. whether it should be:
or, if they need to share a root (some ECC certs are signed using an RSA root):
or simply whether it's not possible to do OCSP with dual format certificates in nginx.
How should this certificate bundle be constructed?