{"record":{"id":"68ddd215a2d900a1","repo":"nats-io/nats-server","slug":"bad-ocsp-responder-http-status-d","errorCode":null,"errorMessage":"bad OCSP responder http status: [%d]","messagePattern":"bad OCSP responder http status: \\[(.+?)\\]","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/certidp/ocsp_responder.go","lineNumber":46,"sourceCode":"\nfunc FetchOCSPResponse(link *ChainLink, opts *OCSPPeerConfig, log *Log) ([]byte, error) {\n\tif link == nil || link.Leaf == nil || link.Issuer == nil || opts == nil || log == nil {\n\t\treturn nil, errors.New(ErrInvalidChainlink)\n\t}\n\n\ttimeout := time.Duration(opts.Timeout * float64(time.Second))\n\tif timeout <= 0*time.Second {\n\t\ttimeout = DefaultOCSPResponderTimeout\n\t}\n\n\tgetRequestBytes := func(u string, hc *http.Client) ([]byte, error) {\n\t\tresp, err := hc.Get(u)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)\n\t\t}\n\t\treturn io.ReadAll(resp.Body)\n\t}\n\n\t// Request documentation:\n\t// https://tools.ietf.org/html/rfc6960#appendix-A.1\n\n\treqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treqEnc := encodeOCSPRequest(reqDER)\n\n\tresponders := *link.OCSPWebEndpoints\n\n\tif len(responders) == 0 {\n\t\treturn nil, errors.New(ErrNoAvailOCSPServers)","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/certidp/ocsp_responder.go#L28-L64","documentation":"OCSP responder fetch: the HTTP request to the OCSP responder URL succeeded at the transport level but returned a status other than 200 OK, so the response body is not a usable OCSP response.","triggerScenarios":"Thrown at server/certidp/ocsp_responder.go:46 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the OCSP responder URL and reachability","Verify the responder expects GET with base64/URL-encoded requests","Point certidp at a healthy responder or fix responder-side errors indicated by the status code"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}