XTLS/Xray-core · error

no issuing certificate URL

Error message

no issuing certificate URL

What it means

Returned when the bundle contains only the leaf certificate and it has no IssuingCertificateURL (AIA 'CA Issuers' field). The OCSP request needs the issuer certificate to compute the issuer key hash, so with neither a bundled issuer nor a fetch URL the lookup is impossible.

Source

Thrown at common/ocsp/ocsp.go:71

	for _, derBytes := range cert {
		err := pem.Encode(bundle, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
		if err != nil {
			return nil, err
		}
	}
	pemBundle := bundle.Bytes()

	certificates, err := parsePEMBundle(pemBundle)
	if err != nil {
		return nil, err
	}
	issuedCert := certificates[0]
	if len(issuedCert.OCSPServer) == 0 {
		return nil, errors.New("no OCSP server specified in cert")
	}
	if len(certificates) == 1 {
		if len(issuedCert.IssuingCertificateURL) == 0 {
			return nil, errors.New("no issuing certificate URL")
		}
		resp, errC := http.Get(issuedCert.IssuingCertificateURL[0])
		if errC != nil {
			return nil, errors.New("no issuing certificate URL")
		}
		defer resp.Body.Close()

		issuerBytes, errC := io.ReadAll(resp.Body)
		if errC != nil {
			return nil, errors.New(errC)
		}

		issuerCert, errC := x509.ParseCertificate(issuerBytes)
		if errC != nil {
			return nil, errors.New(errC)
		}

		certificates = append(certificates, issuerCert)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Include the issuer/intermediate certificate in the PEM bundle so len(certificates) > 1
2. Reissue the cert with an AIA 'CA Issuers' URI pointing at the issuer DER
3. Disable OCSP checking for certificate chains that intentionally omit AIA

Example fix

# before (served bundle)
-----BEGIN CERTIFICATE-----
leaf...
-----END CERTIFICATE-----

# after (bundle leaf + intermediate)
-----BEGIN CERTIFICATE-----
leaf...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
intermediate...
-----END CERTIFICATE-----

if len(certs) == 1 && len(certs[0].IssuingCertificateURL) == 0 {
    return errors.New("bundle must include issuer or cert needs AIA caIssuers URI")
}

func hasIssuerAvailable(certs []*x509.Certificate) bool {
    return len(certs) > 1 || len(certs[0].IssuingCertificateURL) > 0
}

When it happens

Trigger: Supplying a single PEM certificate (leaf only) whose AIA extension lacks the caIssuers URI, i.e. len(certificates) == 1 and len(issuedCert.IssuingCertificateURL) == 0.

Common situations: Self-signed certificates, private CAs that omit AIA, or ops pipelines that strip the intermediate/issuer cert from the served bundle.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no OCSP server specified in cert
• no certificates were found while parsing the bundle
• failed to decode certificate
• failed to produce report
• failed to decode key

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/8f00c8dbdf723a9a. Report an issue: GitHub.