How often does this need to run?

[fusionfoto]

I'm only vaguely familiar with the OCSP stapling process, but its not clear to me -- since this sets a run time value... if we run the updater each time we restart haproxy or each time we update the cert?

thanks in advance -- and very much appreciated you writing this!

[RealXuChe]

you should run it every time you start HAProxy. Consider adding an ExecStartPost entry in your systemd unit to achieve this.

And, OCSP may expire often, for example, an OCSP response on my server from ZeroSSL expires in a week, so you may want to add a crontab task to refresh it every day.