{"record":{"id":"7768dd20b825587e","repo":"nats-io/nats-server","slug":"s-peer-missing-ocsp-staple","errorCode":null,"errorMessage":"%s peer missing OCSP Staple","messagePattern":"(.+?) peer missing OCSP Staple","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":489,"sourceCode":"\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\treturn &tls.Certificate{\n\t\t\t\tOCSPStaple:                   raw,\n\t\t\t\tCertificate:                  ccert.Certificate,\n\t\t\t\tPrivateKey:                   ccert.PrivateKey,\n\t\t\t\tSupportedSignatureAlgorithms: ccert.SupportedSignatureAlgorithms,\n\t\t\t\tSignedCertificateTimestamps:  ccert.SignedCertificateTimestamps,\n\t\t\t\tLeaf:                         ccert.Leaf,\n\t\t\t}, nil\n\t\t}\n\n\t\t// Check whether need to verify staples from a peer router or gateway connection.\n\t\tswitch kind {\n\t\tcase kindStringMap[ROUTER], kindStringMap[GATEWAY]:\n\t\t\ttc.VerifyConnection = func(s tls.ConnectionState) error {\n\t\t\t\toresp := s.OCSPResponse\n\t\t\t\tif oresp == nil {\n\t\t\t\t\treturn fmt.Errorf(\"%s peer missing OCSP Staple\", kind)\n\t\t\t\t}\n\n\t\t\t\t// Peer connections will verify the response of the staple.\n\t\t\t\tif len(s.VerifiedChains) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"%s peer missing TLS verified chains\", kind)\n\t\t\t\t}\n\n\t\t\t\tchain := s.VerifiedChains[0]\n\t\t\t\tpeerLeaf := chain[0]\n\t\t\t\tpeerIssuer := certidp.GetLeafIssuerCert(chain, 0)\n\t\t\t\tif peerIssuer == nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to get issuer certificate for %s peer\", kind)\n\t\t\t\t}\n\n\t\t\t\t// Response signature of issuer or issuer delegate is checked in the library parse\n\t\t\t\tresp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse OCSP response from %s peer: %w\", kind, err)","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L471-L507","documentation":"TLS VerifyConnection callback for cluster/router and gateway peer connections: the peer did not present an OCSP staple (s.OCSPResponse nil) even though the server is configured to require and verify staples from peers of this kind.","triggerScenarios":"Thrown at server/ocsp.go:489 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable OCSP stapling on the peer server's TLS config","Remove the requirement to verify peer staples if not needed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}