{"record":{"id":"0757e6c1c7279ea4","repo":"nats-io/nats-server","slug":"server-not-ocsp-valid","errorCode":null,"errorMessage":"server not OCSP valid","messagePattern":"server not OCSP valid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp_peer.go","lineNumber":196,"sourceCode":"\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\nfunc (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil || config.tlsOpts == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSServer)\n\t}\n\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsServerOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {\n\t\t\ts.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSServerRejectConnection)\n\t\t\treturn errors.New(certidp.MsgTLSServerRejectConnection)\n\t\t}\n\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\n// tlsServerOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP\n// eligibility. A verified chain is considered OCSP Valid if either none of the links are\n// OCSP eligible, or current \"good\" responses from the CA can be obtained for each eligible link.\n// Upon first OCSP Valid chain found, the Server is deemed OCSP Valid. If none of the chains are\n// OCSP Valid, the Server is deemed OCSP Invalid. A verified self-signed certificate (chain length 1)\n// is also considered OCSP Valid.\nfunc (s *Server) tlsServerOCSPValid(chains [][]*x509.Certificate, opts *certidp.OCSPPeerConfig) bool {\n\ts.Debugf(certidp.DbgNumServerChains, len(chains))\n\treturn s.peerOCSPValid(chains, opts)\n}\n\n// tlsClientOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp_peer.go#L178-L214","documentation":"The VerifyConnection callback installed by plugServerTLSOCSPPeer rejected a server-to-server TLS connection (route/gateway/leafnode): the remote server's certificate chain failed OCSP peer validation (tlsServerOCSPValid returned false). A reject event is emitted and the handshake fails.","triggerScenarios":"Thrown at server/ocsp_peer.go:196 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the remote server's certificates have valid OCSP status","Fix OCSP responder reachability from this server","Re-issue or update certificates whose OCSP status is revoked or unknown"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}