{"record":{"id":"758871edc812e672","repo":"nats-io/nats-server","slug":"bad-status-for-ocsp-staple-from-s-peer-s","errorCode":null,"errorMessage":"bad status for OCSP Staple from %s peer: %s","messagePattern":"bad status for OCSP Staple from (.+?) peer: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":532,"sourceCode":"\t\t\t\t\t\tif eku == x509.ExtKeyUsageOCSPSigning {\n\t\t\t\t\t\t\tok = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif !ok {\n\t\t\t\t\t\treturn fmt.Errorf(\"OCSP staple's signer missing authorization by CA to act as OCSP signer\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Check that the OCSP response is effective, take defaults for clockskew and default validity\n\t\t\t\tpeerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}\n\t\t\t\tsLog := certidp.Log{Debugf: srv.Debugf}\n\t\t\t\tif !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {\n\t\t\t\t\treturn fmt.Errorf(\"OCSP staple from %s peer not current\", kind)\n\t\t\t\t}\n\n\t\t\t\tif resp.Status != ocsp.Good {\n\t\t\t\t\treturn fmt.Errorf(\"bad status for OCSP Staple from %s peer: %s\", kind, ocspStatusString(resp.Status))\n\t\t\t\t}\n\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\t// When server makes a peer connection, need to also present an OCSP Staple.\n\t\t\ttc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {\n\t\t\t\tccert := cert\n\t\t\t\traw, _, err := mon.getStatus()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\t// NOTE: crypto/tls.sendClientCertificate internally also calls getClientCertificate\n\t\t\t\t// so if for some reason these callbacks are triggered concurrently during a reconnect\n\t\t\t\t// there can be a race. To avoid that, the OCSP monitor lock is used to serialize access\n\t\t\t\t// to the staple which could also change inflight during an update.\n\t\t\t\tmon.mu.Lock()\n\t\t\t\tccert.OCSPStaple = raw","sourceCodeStart":514,"sourceCodeEnd":550,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L514-L550","documentation":"Peer-verification callback: the staple parsed and was current, but resp.Status is not good (e.g. revoked or unknown), so the peer's certificate status is unacceptable and the TLS handshake fails.","triggerScenarios":"Thrown at server/ocsp.go:532 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Investigate why the peer certificate is revoked/unknown at its CA","Reissue the peer certificate if the revocation was expected"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}