{"record":{"id":"6f4c018e5e5ba3a6","repo":"nats-io/nats-server","slug":"invalid-ocsp-ca-configuration","errorCode":null,"errorMessage":"invalid ocsp ca configuration","messagePattern":"invalid ocsp ca configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":906,"sourceCode":"\t\t}\n\n\t\tpemBytes = append(pemBytes, block.Bytes...)\n\t}\n\n\treturn x509.ParseCertificates(pemBytes)\n}\n\n// getOCSPIssuerLocally determines a leaf's issuer from locally configured certificates\nfunc getOCSPIssuerLocally(trustedCAs []*x509.Certificate, certBundle []*x509.Certificate) (*x509.Certificate, error) {\n\tvar vOpts x509.VerifyOptions\n\tvar leaf *x509.Certificate\n\ttrustedCAPool := x509.NewCertPool()\n\n\t// Require Leaf as first cert in bundle\n\tif len(certBundle) > 0 {\n\t\tleaf = certBundle[0]\n\t} else {\n\t\treturn nil, fmt.Errorf(\"invalid ocsp ca configuration\")\n\t}\n\n\t// Allow Issuer to be configured as second cert in bundle\n\tif len(certBundle) > 1 {\n\t\t// The operator may have misconfigured the cert bundle\n\t\tissuerCandidate := certBundle[1]\n\t\terr := issuerCandidate.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid issuer configuration: %w\", err)\n\t\t} else {\n\t\t\treturn issuerCandidate, nil\n\t\t}\n\t}\n\n\t// Operator did not provide the Leaf Issuer in cert bundle second position\n\t// so we will attempt to create at least one ordered verified chain from the\n\t// trusted CA pool.\n","sourceCodeStart":888,"sourceCodeEnd":924,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L888-L924","documentation":"Returned by getOCSPIssuerLocally when the supplied certificate bundle is empty, so there is no leaf certificate at position 0 to find an issuer for. Despite the message wording, the actual fault is an empty/missing certificate bundle in the OCSP CA configuration, not a malformed CA per se; the TLS/OCSP setup paths (e.g. when reading cert files for OCSP monitoring) depend on that bundle being non-empty.","triggerScenarios":"getOCSPIssuer is called with an empty cert chain (no cert_file bytes parsed) so certBundle has zero entries when getOCSPIssuerLocally runs.","commonSituations":"OCSP enabled in the server config but the certificate bundle failed to load, a misconfigured/misordered cert array, or an empty tls block passed to NewOCSPMonitor.","solutions":["Verify the TLS cert_file loads correctly and yields a non-empty bundle","Ensure the leaf certificate is listed first in the cert file","Re-test with a known-good leaf-first fullchain file"],"exampleFix":"// before (cert file empty or issuer-only)\n# nats.conf missing/invalid ocsp cert source\n// after\n# nats.conf with leaf-first bundle\nocsp: { monitor_list: [443], ... }  # with valid tls cert_file containing leaf first","handlingStrategy":"validation","validationCode":"certs, err := tls.X509KeyPair(certFile, keyFile) // ensure cert chain loads\nif len(certs.Certificate) == 0 { return errors.New(\"empty certificate bundle\") }","typeGuard":"func hasLeaf(chain []*x509.Certificate) bool { return len(chain) > 0 }","tryCatchPattern":null,"preventionTips":["Always place the leaf certificate first in the bundle","Test cert loading at deploy time, not only at OCSP monitor startup","Avoid hand-edited bundle files"],"tags":["ocsp","tls","configuration","certificate-bundle"],"backgroundTag":"missing-tls-certificate","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}