diff --git a/scripts/ocsp.sh b/scripts/ocsp.sh
new file mode 100644
index 0000000000000000000000000000000000000000..b246964452ac52839e4f0d2109e5a46bfde81c06
--- /dev/null
+++ b/scripts/ocsp.sh
@@ -0,0 +1,12 @@
+#!/bin/bash -eux
+
+PEM_FILE=${1}
+CRT_FILE=/tmp/`basename ${PEM_FILE} | sed 's/pem/crt/'`
+DIR=`dirname ${PEM_FILE}`
+URL=`openssl x509 -in ${PEM_FILE} -text | grep OCSP | cut -d: -f2,3`
+HEADER=`echo $URL | cut -d/ -f3`
+ISSUER_CRT_URL=`openssl x509 -in ${PEM_FILE} -text | grep Issuers | cut -d: -f2,3`
+wget ${ISSUER_CRT_URL} -q -O - | openssl x509 -inform DER -outform PEM > ${PEM_FILE}.issuer
+openssl x509 -outform PEM -in ${PEM_FILE} > ${CRT_FILE}
+openssl ocsp -noverify -issuer ${PEM_FILE}.issuer -cert ${CRT_FILE} -url ${URL} -no_nonce -header Host ${HEADER}  -respout ${PEM_FILE}.ocsp
+
diff --git a/unit-files/ocsp.service b/unit-files/ocsp.service
new file mode 100644
index 0000000000000000000000000000000000000000..02a54f0052669680a7275b87e3716a581cf2518e
--- /dev/null
+++ b/unit-files/ocsp.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Get the OCSP data from the cert provider
+
+[Service]
+Type=oneshot
+TimeoutStartSec=0
+ExecStart=/bin/bash -euxc ' \
+  for cert in `ls /data/runtime/haproxy/approved-certs/*.pem`;do \
+    /data/indiehosters/scripts/ocsp.sh $cert; \
+  done'
+
diff --git a/unit-files/ocsp.timer b/unit-files/ocsp.timer
new file mode 100644
index 0000000000000000000000000000000000000000..891b45f1824cb546189e8a2cf0f3eb75a9642147
--- /dev/null
+++ b/unit-files/ocsp.timer
@@ -0,0 +1,6 @@
+[Unit]
+Description=Daily timer for OCSP stapling
+
+[Timer]
+OnUnitActiveSec=1day
+