{"record":{"id":"0d9012aa7dcc9092","repo":"nats-io/nats-server","slug":"exhausted-ocsp-responders-w","errorCode":null,"errorMessage":"exhausted OCSP responders: %w","messagePattern":"exhausted OCSP responders: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certidp/ocsp_responder.go","lineNumber":81,"sourceCode":"\tif len(responders) == 0 {\n\t\treturn nil, errors.New(ErrNoAvailOCSPServers)\n\t}\n\n\tvar raw []byte\n\thc := &http.Client{\n\t\tTimeout: timeout,\n\t}\n\tfor _, u := range responders {\n\t\tresponderURL := u.String()\n\t\tlog.Debugf(DbgMakingCARequest, responderURL)\n\t\tresponderURL = strings.TrimSuffix(responderURL, \"/\")\n\t\traw, err = getRequestBytes(fmt.Sprintf(\"%s/%s\", responderURL, reqEnc), hc)\n\t\tif err == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(ErrFailedWithAllRequests, err)\n\t}\n\n\treturn raw, nil\n}\n\n// encodeOCSPRequest encodes the OCSP request in base64 and URL-encodes it.\n// This is needed to fulfill the OCSP responder's requirements for the request format. (X.690)\nfunc encodeOCSPRequest(reqDER []byte) string {\n\treqEnc := base64.StdEncoding.EncodeToString(reqDER)\n\treturn url.QueryEscape(reqEnc)\n}\n","sourceCodeStart":63,"sourceCodeEnd":93,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certidp/ocsp_responder.go#L63-L93","documentation":"All configured/defaulted OCSP responder URLs were tried in sequence and every getRequestBytes call failed (network error or non-200); the last error is wrapped and reported as exhaustion of the responder list.","triggerScenarios":"Thrown at server/certidp/ocsp_responder.go:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restore connectivity to at least one OCSP responder","Verify responder URLs in the AIA extension or configured peers","Check TLS/firewall settings blocking the responder requests"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}