{"record":{"id":"6edb64867ba5e757","repo":"nats-io/nats-server","slug":"client-not-ocsp-valid","errorCode":null,"errorMessage":"client not OCSP valid","messagePattern":"client not OCSP valid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp_peer.go","lineNumber":176,"sourceCode":"\t\treturn s.plugServerTLSOCSPPeer(config)\n\t}\n\treturn nil, false, nil\n}\n\nfunc (s *Server) plugClientTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil || config.tlsOpts == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSClient)\n\t}\n\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsClientOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {\n\t\t\ts.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSClientRejectConnection)\n\t\t\treturn errors.New(certidp.MsgTLSClientRejectConnection)\n\t\t}\n\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\nfunc (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil || config.tlsOpts == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSServer)\n\t}\n\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsServerOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp_peer.go#L158-L194","documentation":"The VerifyConnection callback installed by plugClientTLSOCSPPeer rejected an inbound client TLS connection: the client's verified certificate chain failed OCSP peer validation (tlsClientOCSPValid returned false). An OCSP peer reject event is emitted and the handshake fails with this error.","triggerScenarios":"Thrown at server/ocsp_peer.go:176 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure client certificates have valid, non-revoked OCSP status from a reachable responder","Re-issue the client certificate if its OCSP status is revoked or unknown","Relax or disable OCSP peer verification on the listener if not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}