{"record":{"id":"11beb76a08f37d12","repo":"nats-io/nats-server","slug":"unable-to-register-server-ocsp-verification","errorCode":null,"errorMessage":"unable to register server OCSP verification","messagePattern":"unable to register server OCSP verification","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp_peer.go","lineNumber":185,"sourceCode":"\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsClientOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {\n\t\t\ts.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSClientRejectConnection)\n\t\t\treturn errors.New(certidp.MsgTLSClientRejectConnection)\n\t\t}\n\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\nfunc (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil || config.tlsOpts == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSServer)\n\t}\n\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsServerOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {\n\t\t\ts.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSServerRejectConnection)\n\t\t\treturn errors.New(certidp.MsgTLSServerRejectConnection)\n\t\t}\n\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\n// tlsServerOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp_peer.go#L167-L203","documentation":"Guard inside plugServerTLSOCSPPeer: the tlsConfigKind passed in is incomplete (nil config, nil tlsConfig, or nil tlsOpts), so the server-side OCSP VerifyConnection hook cannot be installed. It indicates broken internal TLS wiring while plugging OCSP verification, not a peer problem.","triggerScenarios":"Thrown at server/ocsp_peer.go:185 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the server TLS block fully specifies cert/key before enabling OCSP peer verification","Verify the tlsConfigKind passed to plugTLSOCSPPeer is fully populated","Report as a server bug if the configuration appears complete"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}