{"record":{"id":"30afbb8ae0a9c1f6","repo":"nats-io/nats-server","slug":"failed-to-parse-ocsp-response-from-s-peer-w","errorCode":null,"errorMessage":"failed to parse OCSP response from %s peer: %w","messagePattern":"failed to parse OCSP response from (.+?) peer: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":507,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"%s peer missing OCSP Staple\", kind)\n\t\t\t\t}\n\n\t\t\t\t// Peer connections will verify the response of the staple.\n\t\t\t\tif len(s.VerifiedChains) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"%s peer missing TLS verified chains\", kind)\n\t\t\t\t}\n\n\t\t\t\tchain := s.VerifiedChains[0]\n\t\t\t\tpeerLeaf := chain[0]\n\t\t\t\tpeerIssuer := certidp.GetLeafIssuerCert(chain, 0)\n\t\t\t\tif peerIssuer == nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to get issuer certificate for %s peer\", kind)\n\t\t\t\t}\n\n\t\t\t\t// Response signature of issuer or issuer delegate is checked in the library parse\n\t\t\t\tresp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse OCSP response from %s peer: %w\", kind, err)\n\t\t\t\t}\n\n\t\t\t\t// If signer was issuer delegate double-check issuer delegate authorization\n\t\t\t\tif resp.Certificate != nil {\n\t\t\t\t\tok := false\n\t\t\t\t\tfor _, eku := range resp.Certificate.ExtKeyUsage {\n\t\t\t\t\t\tif eku == x509.ExtKeyUsageOCSPSigning {\n\t\t\t\t\t\t\tok = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif !ok {\n\t\t\t\t\t\treturn fmt.Errorf(\"OCSP staple's signer missing authorization by CA to act as OCSP signer\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Check that the OCSP response is effective, take defaults for clockskew and default validity\n\t\t\t\tpeerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}","sourceCodeStart":489,"sourceCodeEnd":525,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L489-L525","documentation":"Peer-verification callback: the stapled OCSP bytes could not be parsed for the specific peer leaf and issuer (ocsp.ParseResponseForCert failed — malformed response, wrong serial, or bad signature). The library/parse error is wrapped.","triggerScenarios":"Thrown at server/ocsp.go:507 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the staple actually corresponds to the peer certificate","Regenerate the staple on the peer from its CA"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}