XTLS/Xray-core · error

no OCSP server specified in cert

Error message

no OCSP server specified in cert

What it means

Returned by the OCSP client when the certificate bundle's leaf (first) certificate contains no AIA OCSP URL (empty OCSPServer field). Without an OCSP responder URL the client has nothing to query, so OCSP status checking cannot proceed.

Source

Thrown at common/ocsp/ocsp.go:67

}

func GetOCSPForCert(cert [][]byte) ([]byte, error) {
	bundle := new(bytes.Buffer)
	for _, derBytes := range cert {
		err := pem.Encode(bundle, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
		if err != nil {
			return nil, err
		}
	}
	pemBundle := bundle.Bytes()

	certificates, err := parsePEMBundle(pemBundle)
	if err != nil {
		return nil, err
	}
	issuedCert := certificates[0]
	if len(issuedCert.OCSPServer) == 0 {
		return nil, errors.New("no OCSP server specified in cert")
	}
	if len(certificates) == 1 {
		if len(issuedCert.IssuingCertificateURL) == 0 {
			return nil, errors.New("no issuing certificate URL")
		}
		resp, errC := http.Get(issuedCert.IssuingCertificateURL[0])
		if errC != nil {
			return nil, errors.New("no issuing certificate URL")
		}
		defer resp.Body.Close()

		issuerBytes, errC := io.ReadAll(resp.Body)
		if errC != nil {
			return nil, errors.New(errC)
		}

		issuerCert, errC := x509.ParseCertificate(issuerBytes)
		if errC != nil {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Reissue the certificate with an OCSP AIA URL (add AuthorityInformationAccess with an OCSP endpoint)
2. If the CA does not provide OCSP, disable OCSP stapling/revocation checking for that cert and rely on CRLs instead
3. Use a public CA certificate that includes OCSP endpoints when revocation checking is required

Example fix

// before
resp, err := ocspClient.GetOCSPForCert(certDER) // self-signed cert

// after
if len(leafCert.OCSPServer) == 0 {
    log.Warn("cert has no OCSP responder; skipping OCSP check")
    return nil, nil
}

leaf, _ := firstCert(bundlePEM)
if len(leaf.OCSPServer) == 0 {
    log.Warn("no OCSP AIA in cert; skipping revocation check")
    return nil, nil
}

func hasOCSPServer(c *x509.Certificate) bool { return len(c.OCSPServer) > 0 }

if err != nil && strings.Contains(err.Error(), "no OCSP server") { disableOCSPFor(cert) }

When it happens

Trigger: Calling the OCSP request builder with a certificate issued without an OCSP AIA extension - common with self-signed certificates, internal/private CAs, or certs that only ship CRL distribution points.

Common situations: Enabling certificate revocation checking in TLS inbound settings while using self-signed or enterprise CA certificates that lack the OCSP AIA extension.

Related errors

• no issuing certificate URL
• no certificates were found while parsing the bundle
• failed to decode certificate
• failed to produce report
• failed to decode key

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/88b35fad6439d529. Report an issue: GitHub.