Add OCSP stapling support for automatic and custom TLS certificates

[crmne]

Hi. We are using Kamal Proxy with automatic TLS for a Rails application and recently checked the TLS evidence needed for a CASA/security assessment. The certificate chain and TLS configuration are healthy, but openssl s_client -status shows that Kamal Proxy is not stapling an OCSP response:

openssl s_client -connect chatwithwork.com:443 -servername chatwithwork.com -status

Relevant output:

OCSP responses: no responses sent
Verification: OK
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Verify return code: 0 (ok)

For assessments that require evidence for certificate revocation handling, this currently means we need to either submit a compensating control, put another TLS terminator in front of Kamal Proxy, or maintain a custom proxy build. We would prefer to keep using official Kamal Proxy for TLS termination.

From a quick source review, Kamal Proxy currently:

• Uses golang.org/x/crypto/acme/autocert.Manager for automatic TLS in internal/server/service.go.
• Loads custom certs with tls.LoadX509KeyPair in internal/server/cert.go.
• Returns certificates through GetCertificate in internal/server/router.go.
• Configures TLS in internal/server/server.go.

I did not find any code that fetches/caches OCSP responses or populates tls.Certificate.OCSPStaple, and I did not find a CLI/deploy option to enable stapling.

Would you be open to OCSP stapling support for certificates served by Kamal Proxy? If so, would you prefer that I open a PR for this, or would you rather take it on yourselves?

Possible shape:

• Fetch the OCSP response for the leaf certificate using the issuer certificate and the OCSP server URL from the certificate.
• Cache the response alongside the ACME certificate cache or in another proxy-managed cache location.
• Refresh the staple before NextUpdate, with a fallback that continues serving the certificate if the responder is temporarily unavailable.
• Populate tls.Certificate.OCSPStaple before returning the certificate from GetCertificate.
• Support both automatic ACME certificates and custom certificate/key paths where possible.

It would also be useful to expose a way to disable stapling if needed, but enabling it by default for eligible certificates would match common TLS terminator behavior and would help users satisfy security assessment requirements without adding a second proxy.

Thanks for considering it.