{"record":{"id":"7bdcf5b5637a8811","repo":"nats-io/nats-server","slug":"unable-to-register-client-ocsp-verification","errorCode":null,"errorMessage":"unable to register client OCSP verification","messagePattern":"unable to register client OCSP verification","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp_peer.go","lineNumber":165,"sourceCode":"\t}\n\ts.Debugf(certidp.DbgPlugTLSForKind, config.kind)\n\t// peer is a tls client\n\tif kind == kindStringMap[CLIENT] || (kind == kindStringMap[LEAF] && !isSpoke) {\n\t\tif !tcOpts.Verify {\n\t\t\treturn nil, false, errors.New(certidp.ErrMTLSRequired)\n\t\t}\n\t\treturn s.plugClientTLSOCSPPeer(config)\n\t}\n\t// peer is a tls server\n\tif kind == kindStringMap[LEAF] && isSpoke {\n\t\treturn s.plugServerTLSOCSPPeer(config)\n\t}\n\treturn nil, false, nil\n}\n\nfunc (s *Server) plugClientTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil || config.tlsOpts == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSClient)\n\t}\n\ttc := config.tlsConfig\n\ttcOpts := config.tlsOpts\n\tkind := config.kind\n\tif tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn tc, false, nil\n\t}\n\ttc.VerifyConnection = func(cs tls.ConnectionState) error {\n\t\tif !s.tlsClientOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {\n\t\t\ts.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSClientRejectConnection)\n\t\t\treturn errors.New(certidp.MsgTLSClientRejectConnection)\n\t\t}\n\t\treturn nil\n\t}\n\treturn tc, true, nil\n}\n\nfunc (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp_peer.go#L147-L183","documentation":"Raised in Server.plugClientTLSOCSPPeer (server/ocsp_peer.go:165) when the client-kind TLS wrapper passed from plugTLSOCSPPeer is missing its config, tlsConfig, or tlsOpts, so the OCSP VerifyConnection callback cannot be registered on the client TLS config (certidp.ErrUnableToPlugTLSClient). It is a defensive invariant check that fails server startup rather than allowing OCSP peer verification to be silently skipped.","triggerScenarios":"plugClientTLSOCSPPeer receives a *tlsConfigKind whose tlsOpts was nil even though an earlier coarse check passed, or whose tlsConfig is nil — an internal inconsistency when enableOCSP/reloadOCSP assembles the client TLS config while OCSP peer verify is enabled.","commonSituations":"Partial config loads during hot reload where TLS options are parsed after the OCSP plugging step; custom embedding of the server that constructs tlsConfigKind manually and leaves tlsOpts unset; race during concurrent reload/OCSP enable.","solutions":["Ensure the full TLS options (tls block parsed into tlsOpts) are loaded before OCSP plugging; do not enable OCSP on a half-parsed config","If embedding the server, populate all fields of the tlsConfigKind (config, tlsConfig, tlsOpts) before calling enableOCSP-related paths","Retry or re-trigger the reload with the complete config; if it persists, capture the config file and report with the NATS server version"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go: catch the startup failure and retry with a fully loaded config\nif err := srv.Start(); err != nil && strings.Contains(err.Error(), \"unable to register client OCSP verification\") {\n    log.Errorf(\"OCSP client plugging failed: %v; reloading full TLS config\", err)\n    reloadFullTLSConfig()\n    srv.Start()\n}","preventionTips":["Load and parse the entire TLS config before enabling OCSP hooks; avoid partial hot reloads","If embedding nats-server, always populate tlsConfigKind fully (config, tlsConfig, tlsOpts)","Pin a stable server version and test config reloads with OCSP enabled in staging"],"tags":["tls","ocsp","config","nats-server","startup"],"backgroundTag":"ocsp-setup-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}