{"record":{"id":"4bc7a10faee7a2cf","repo":"nats-io/nats-server","slug":"found-existing-ocsp-status-for-certificate-at-s","errorCode":null,"errorMessage":"found existing OCSP status for certificate at '%s': %s","messagePattern":"found existing OCSP status for certificate at '(.+?)': (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":459,"sourceCode":"\t\t\treturn nil, nil, err\n\t\t}\n\n\t\tmon = &OCSPMonitor{\n\t\t\tkind:             kind,\n\t\t\tsrv:              srv,\n\t\t\thc:               &http.Client{Timeout: 30 * time.Second},\n\t\t\tshutdownOnRevoke: shutdownOnRevoke,\n\t\t\tcertFile:         certFile,\n\t\t\tstopCh:           make(chan struct{}, 1),\n\t\t\tLeaf:             cert.Leaf,\n\t\t\tIssuer:           issuer,\n\t\t}\n\n\t\t// Get the certificate status from the memory, then remote OCSP responder.\n\t\tif _, resp, err := mon.getStatus(); err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"bad OCSP status update for certificate at '%s': %s\", certFile, err)\n\t\t} else if resp != nil && resp.Status != ocsp.Good && shutdownOnRevoke {\n\t\t\treturn nil, nil, fmt.Errorf(\"found existing OCSP status for certificate at '%s': %s\", certFile, ocspStatusString(resp.Status))\n\t\t}\n\n\t\t// Callbacks below will be in charge of returning the certificate instead,\n\t\t// so this has to be nil.\n\t\ttc.Certificates = nil\n\n\t\t// GetCertificate returns a certificate that's presented to a client.\n\t\ttc.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {\n\t\t\tccert := cert\n\t\t\traw, _, err := mon.getStatus()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\treturn &tls.Certificate{\n\t\t\t\tOCSPStaple:                   raw,\n\t\t\t\tCertificate:                  ccert.Certificate,\n\t\t\t\tPrivateKey:                   ccert.PrivateKey,\n\t\t\t\tSupportedSignatureAlgorithms: ccert.SupportedSignatureAlgorithms,","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L441-L477","documentation":"NewOCSPMonitor: getStatus() returned an existing (cached) OCSP response whose status or validity is reported in this message during monitor bootstrap for the certificate. It surfaces the state of the pre-existing staple found for the cert file.","triggerScenarios":"Thrown at server/ocsp.go:459 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the reported existing status; renew or revoke handling as appropriate","Clear the cached OCSP entry to force a fresh fetch from the responder"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}