{"record":{"id":"3d523f38de49f12f","repo":"nats-io/nats-server","slug":"failed-to-get-local-status-w","errorCode":null,"errorMessage":"failed to get local status: %w","messagePattern":"failed to get local status: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":145,"sourceCode":"\tstoreDir := opts.StoreDir\n\tif storeDir == _EMPTY_ {\n\t\treturn nil, nil, fmt.Errorf(\"store_dir not set\")\n\t}\n\n\t// This key must be based upon the current full certificate, not the public key,\n\t// so MUST be on the full raw certificate and not an SPKI or other reduced form.\n\tkey := fmt.Sprintf(\"%x\", sha256.Sum256(oc.Leaf.Raw))\n\n\toc.mu.Lock()\n\traw, err := os.ReadFile(filepath.Join(storeDir, defaultOCSPStoreDir, key))\n\toc.mu.Unlock()\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tresp, err := ocsp.ParseResponse(raw, oc.Issuer)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to get local status: %w\", err)\n\t}\n\tif err := validOCSPResponse(resp); err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\t// Cache the response.\n\toc.mu.Lock()\n\toc.raw = raw\n\toc.resp = resp\n\toc.mu.Unlock()\n\n\treturn raw, resp, nil\n}\n\nfunc (oc *OCSPMonitor) getRemoteStatus() ([]byte, *ocsp.Response, error) {\n\topts := oc.srv.getOpts()\n\tvar overrideURLs []string\n\tif config := opts.OCSPConfig; config != nil {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L127-L163","documentation":"Wrap produced in getLocalStatus when the cached OCSP bytes read from disk cannot be parsed by ocsp.ParseResponse (corrupted cache file, truncated write, or wrong issuer). The getStatus caller treats it as a cache miss and falls back to the remote responder.","triggerScenarios":"Thrown at server/ocsp.go:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Let the monitor refresh the staple from the remote OCSP responder (automatic fallback)","Delete the corrupted cache file under <store_dir>/jetstream/ocsp if stale entries persist"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}