{"record":{"id":"3cd363418cddb85b","repo":"nats-io/nats-server","slug":"s-invalid-ca-basic-constraints-is-not-ca","errorCode":null,"errorMessage":"%s invalid ca basic constraints: is not ca","messagePattern":"(.+?) invalid ca basic constraints: is not ca","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":968,"sourceCode":"\t\t}\n\t}\n\n\t// Specify bundled intermediate CA store\n\tfor _, certBytes := range chain {\n\t\tcert, err := x509.ParseCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse cert: %v\", err)\n\t\t}\n\t\tcertBundle = append(certBundle, cert)\n\t}\n\n\tissuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)\n\tif err != nil || issuer == nil {\n\t\treturn nil, fmt.Errorf(\"no issuers found\")\n\t}\n\n\tif !issuer.IsCA {\n\t\treturn nil, fmt.Errorf(\"%s invalid ca basic constraints: is not ca\", issuer.Subject)\n\t}\n\treturn issuer, nil\n}\n\nfunc ocspStatusString(n int) string {\n\tswitch n {\n\tcase ocsp.Good:\n\t\treturn \"good\"\n\tcase ocsp.Revoked:\n\t\treturn \"revoked\"\n\tdefault:\n\t\treturn \"unknown\"\n\t}\n}\n\nfunc validOCSPResponse(r *ocsp.Response) error {\n\t// Time validation not handled by ParseResponse.\n\t// https://tools.ietf.org/html/rfc6960#section-4.2.2.1","sourceCodeStart":950,"sourceCodeEnd":986,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L950-L986","documentation":"After resolving the issuer, getOCSPIssuer enforces that the issuer certificate actually has IsCA set (BasicConstraints CA=true). A non-CA certificate selected as issuer is rejected with the issuer's subject in the message.","triggerScenarios":"The certificate found as issuer (from ca_file trust pool or bundle position 2) parses fine and matches, but has IsCA == false — e.g. a leaf/endpoint cert was supplied as the issuer.","commonSituations":"Operators copy the wrong cert into position 2 of the bundle (another leaf instead of the intermediate), or point ca_file at a server certificate instead of a CA cert.","solutions":["Replace the second bundle entry with the real intermediate CA cert","Verify with `openssl x509 -in issuer.pem -text | grep 'CA:'` that it shows CA:TRUE","Re-export the intermediate CA from the chain provided by your CA vendor"],"exampleFix":"// before\ncat leaf.pem another-leaf.pem > bundle.pem\n// after\ncat leaf.pem intermediate-ca.pem > bundle.pem\n# intermediate-ca.pem must contain Basic Constraints: CA:TRUE","handlingStrategy":"validation","validationCode":"for _, c := range bundle[1:] {\n    if !c.IsCA { return fmt.Errorf(\"%s is not a CA cert\", c.Subject) }\n}","typeGuard":"func isCA(c *x509.Certificate) bool { return c != nil && c.IsCA }","tryCatchPattern":null,"preventionTips":["Confirm Basic Constraints CA:TRUE with openssl on all issuer certs","Never place endpoint certs in issuer positions","Keep root/intermediate CA files separate from server cert files"],"tags":["ocsp","x509","certificate-constraints","configuration"],"backgroundTag":"certificate-not-a-ca","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}