{"record":{"id":"608f3e096d4fc61f","repo":"nats-io/nats-server","slug":"no-available-ocsp-servers","errorCode":null,"errorMessage":"no available OCSP servers","messagePattern":"no available OCSP servers","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/certidp/ocsp_responder.go","lineNumber":64,"sourceCode":"\t\t\treturn nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)\n\t\t}\n\t\treturn io.ReadAll(resp.Body)\n\t}\n\n\t// Request documentation:\n\t// https://tools.ietf.org/html/rfc6960#appendix-A.1\n\n\treqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treqEnc := encodeOCSPRequest(reqDER)\n\n\tresponders := *link.OCSPWebEndpoints\n\n\tif len(responders) == 0 {\n\t\treturn nil, errors.New(ErrNoAvailOCSPServers)\n\t}\n\n\tvar raw []byte\n\thc := &http.Client{\n\t\tTimeout: timeout,\n\t}\n\tfor _, u := range responders {\n\t\tresponderURL := u.String()\n\t\tlog.Debugf(DbgMakingCARequest, responderURL)\n\t\tresponderURL = strings.TrimSuffix(responderURL, \"/\")\n\t\traw, err = getRequestBytes(fmt.Sprintf(\"%s/%s\", responderURL, reqEnc), hc)\n\t\tif err == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(ErrFailedWithAllRequests, err)\n\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certidp/ocsp_responder.go#L46-L82","documentation":"This error (ErrNoAvailOCSPServers) is returned by FetchOCSPResponse when the certificate's chain link has no OCSP responder endpoints to query (link.OCSPWebEndpoints is empty). The library cannot perform an OCSP check without at least one AIA/web endpoint from the certificate, so it fails fast.","triggerScenarios":"Calling FetchOCSPResponse on a ChainLink whose OCSPWebEndpoints list is empty/nil — i.e. the certificate carries no OCSP URL in its Authority Information Access extension.","commonSituations":"Using certificates issued by a CA that omits OCSP URLs, private/internal CAs without an OCSP responder, or stripped certificate extensions.","solutions":["Use certificates issued by a CA whose certs include an OCSP responder URL (AIA extension)","If using a private CA, deploy an OCSP responder and issue certs with its URL in AIA","Re-issue certificates with the OCSP endpoint included, then reload the server's certificate","Disable OCSP-based peer verification (CertIDP) if your PKI does not support OCSP"],"exampleFix":"// before\n// cert has no OCSP URL -> FetchOCSPResponse fails\n// after (openssl config)\nauthorityInfoAccess = OCSP;URI:http://ocsp.example.com\n// re-issue certificate with AIA OCSP URI","handlingStrategy":"validation","validationCode":"func hasOCSPResponder(link *certidp.ChainLink) bool {\n    return link != nil && link.OCSPWebEndpoints != nil && len(*link.OCSPWebEndpoints) > 0\n}\nif !hasOCSPResponder(link) {\n    log.Warn(\"certificate has no OCSP responder URL; skipping OCSP check\")\n    return true, nil // or fail depending on policy\n}","typeGuard":null,"tryCatchPattern":"resp, err := certidp.FetchOCSPResponse(link, opts, log)\nif err != nil {\n    log.Warnf(\"no OCSP responder available for peer cert: %v\", err)\n    // fall back to policy: allow, deny, or warn\n}","preventionTips":["Issue certificates with AIA OCSP URIs from your CA","Stand up an OCSP responder for private PKIs before enabling CertIDP","Decide an explicit fallback policy for certs without OCSP endpoints"],"tags":["tls","ocsp","certificates","network","pkix"],"backgroundTag":"no-ocsp-responder-url","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}