{"record":{"id":"82f69c43543881df","repo":"nats-io/nats-server","slug":"error-parsing-certificate-v","errorCode":null,"errorMessage":"error parsing certificate: %v","messagePattern":"error parsing certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":404,"sourceCode":"\t\tcaFile = tcOpts.CaFile\n\t}\n\n\t// NOTE: Currently OCSP Stapling is enabled only for the first certificate found.\n\tvar mon *OCSPMonitor\n\tfor _, currentCert := range tc.Certificates {\n\t\t// Create local copy since this will be used in the GetCertificate callback.\n\t\tcert := currentCert\n\n\t\t// This is normally non-nil, but can still be nil here when in tests\n\t\t// or in some embedded scenarios.\n\t\tif cert.Leaf == nil {\n\t\t\tif len(cert.Certificate) <= 0 {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"no certificate found\")\n\t\t\t}\n\t\t\tvar err error\n\t\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t\t}\n\t\t}\n\t\tvar shutdownOnRevoke bool\n\t\tmustStaple := hasOCSPStatusRequest(cert.Leaf)\n\t\tif oc != nil {\n\t\t\tswitch {\n\t\t\tcase oc.Mode == OCSPModeNever:\n\t\t\t\tif mustStaple {\n\t\t\t\t\tsrv.Warnf(\"Certificate at '%s' has MustStaple but OCSP is disabled\", certFile)\n\t\t\t\t}\n\t\t\t\treturn tc, nil, nil\n\t\t\tcase oc.Mode == OCSPModeAlways:\n\t\t\t\t// Start the monitor for this cert even if it does not have\n\t\t\t\t// the MustStaple flag and shutdown the server in case the\n\t\t\t\t// staple ever gets revoked.\n\t\t\t\tmustStaple = true\n\t\t\t\tshutdownOnRevoke = true\n\t\t\tcase oc.Mode == OCSPModeMust && mustStaple:","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L386-L422","documentation":"NewOCSPMonitor: the first chain element of the certificate could not be parsed by x509.ParseCertificate, so the Leaf needed for OCSP request creation is unavailable. The underlying parse error is included.","triggerScenarios":"Thrown at server/ocsp.go:404 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the cert file is a valid PEM/DER certificate","Regenerate or re-provision the certificate and restart/reload"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}