{"record":{"id":"01be40d10511d82c","repo":"nats-io/nats-server","slug":"invalid-issuer-configuration-w","errorCode":null,"errorMessage":"invalid issuer configuration: %w","messagePattern":"invalid issuer configuration: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":915,"sourceCode":"func getOCSPIssuerLocally(trustedCAs []*x509.Certificate, certBundle []*x509.Certificate) (*x509.Certificate, error) {\n\tvar vOpts x509.VerifyOptions\n\tvar leaf *x509.Certificate\n\ttrustedCAPool := x509.NewCertPool()\n\n\t// Require Leaf as first cert in bundle\n\tif len(certBundle) > 0 {\n\t\tleaf = certBundle[0]\n\t} else {\n\t\treturn nil, fmt.Errorf(\"invalid ocsp ca configuration\")\n\t}\n\n\t// Allow Issuer to be configured as second cert in bundle\n\tif len(certBundle) > 1 {\n\t\t// The operator may have misconfigured the cert bundle\n\t\tissuerCandidate := certBundle[1]\n\t\terr := issuerCandidate.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid issuer configuration: %w\", err)\n\t\t} else {\n\t\t\treturn issuerCandidate, nil\n\t\t}\n\t}\n\n\t// Operator did not provide the Leaf Issuer in cert bundle second position\n\t// so we will attempt to create at least one ordered verified chain from the\n\t// trusted CA pool.\n\n\t// Specify CA trust store to validator; if unset, system trust store used\n\tif len(trustedCAs) > 0 {\n\t\tfor _, ca := range trustedCAs {\n\t\t\ttrustedCAPool.AddCert(ca)\n\t\t}\n\t\tvOpts.Roots = trustedCAPool\n\t}\n\n\treturn certstore.GetLeafIssuer(leaf, vOpts), nil","sourceCodeStart":897,"sourceCodeEnd":933,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L897-L933","documentation":"When a second certificate is present in the bundle, it is assumed to be the leaf's issuer and is verified via CheckSignature. If the second cert's signature does not verify the leaf's TBS certificate, the bundle issuer is misconfigured and the underlying x509 error is wrapped and returned.","triggerScenarios":"certBundle[1] fails CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature) — the second cert is not the CA that signed the leaf.","commonSituations":"Operators concatenate certificates from unrelated chains, place an intermediate in the wrong order, or pass a fullchain where the second cert belongs to a different leaf (e.g. copied wrong fullchain after cert renewal).","solutions":["Confirm the second certificate in the bundle actually signed the leaf (openssl verify -CAfile issuer.pem leaf.pem)","Rebuild the bundle in the correct order: leaf first, then its direct issuer","Regenerate/re-download the fullchain from the CA after certificate renewal"],"exampleFix":"// before\ncat server.crt other-ca.pem > bundle.pem\n// after\ncat server.crt real-intermediate.pem > bundle.pem\n# openssl verify -CAfile real-intermediate.pem server.crt","handlingStrategy":"validation","validationCode":"leaf, issuer := bundle[0], bundle[1]\nif err := issuer.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature); err != nil {\n    return fmt.Errorf(\"bundle position 2 is not the leaf's issuer: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Regenerate fullchain bundles from the CA tooling, never by hand","Run `openssl verify -CAfile issuer.pem leaf.pem` before deploy","After cert renewal, rebuild the bundle rather than reusing the old one"],"tags":["tls","ocsp","certificate-chain","x509"],"backgroundTag":"certificate-chain-mismatch","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}