{"record":{"id":"88b35fad6439d529","repo":"XTLS/Xray-core","slug":"no-ocsp-server-specified-in-cert","errorCode":null,"errorMessage":"no OCSP server specified in cert","messagePattern":"no OCSP server specified in cert","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/ocsp/ocsp.go","lineNumber":67,"sourceCode":"}\n\nfunc GetOCSPForCert(cert [][]byte) ([]byte, error) {\n\tbundle := new(bytes.Buffer)\n\tfor _, derBytes := range cert {\n\t\terr := pem.Encode(bundle, &pem.Block{Type: \"CERTIFICATE\", Bytes: derBytes})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tpemBundle := bundle.Bytes()\n\n\tcertificates, err := parsePEMBundle(pemBundle)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tissuedCert := certificates[0]\n\tif len(issuedCert.OCSPServer) == 0 {\n\t\treturn nil, errors.New(\"no OCSP server specified in cert\")\n\t}\n\tif len(certificates) == 1 {\n\t\tif len(issuedCert.IssuingCertificateURL) == 0 {\n\t\t\treturn nil, errors.New(\"no issuing certificate URL\")\n\t\t}\n\t\tresp, errC := http.Get(issuedCert.IssuingCertificateURL[0])\n\t\tif errC != nil {\n\t\t\treturn nil, errors.New(\"no issuing certificate URL\")\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tissuerBytes, errC := io.ReadAll(resp.Body)\n\t\tif errC != nil {\n\t\t\treturn nil, errors.New(errC)\n\t\t}\n\n\t\tissuerCert, errC := x509.ParseCertificate(issuerBytes)\n\t\tif errC != nil {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/ocsp/ocsp.go#L49-L85","documentation":"Returned by the OCSP client when the certificate bundle's leaf (first) certificate contains no AIA OCSP URL (empty OCSPServer field). Without an OCSP responder URL the client has nothing to query, so OCSP status checking cannot proceed.","triggerScenarios":"Calling the OCSP request builder with a certificate issued without an OCSP AIA extension - common with self-signed certificates, internal/private CAs, or certs that only ship CRL distribution points.","commonSituations":"Enabling certificate revocation checking in TLS inbound settings while using self-signed or enterprise CA certificates that lack the OCSP AIA extension.","solutions":["Reissue the certificate with an OCSP AIA URL (add AuthorityInformationAccess with an OCSP endpoint)","If the CA does not provide OCSP, disable OCSP stapling/revocation checking for that cert and rely on CRLs instead","Use a public CA certificate that includes OCSP endpoints when revocation checking is required"],"exampleFix":"// before\nresp, err := ocspClient.GetOCSPForCert(certDER) // self-signed cert\n\n// after\nif len(leafCert.OCSPServer) == 0 {\n    log.Warn(\"cert has no OCSP responder; skipping OCSP check\")\n    return nil, nil\n}","handlingStrategy":"validation","validationCode":"leaf, _ := firstCert(bundlePEM)\nif len(leaf.OCSPServer) == 0 {\n    log.Warn(\"no OCSP AIA in cert; skipping revocation check\")\n    return nil, nil\n}","typeGuard":"func hasOCSPServer(c *x509.Certificate) bool { return len(c.OCSPServer) > 0 }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no OCSP server\") { disableOCSPFor(cert) }","preventionTips":["Check the AIA extension before enabling OCSP","Prefer public CAs when revocation checking matters"],"tags":["tls","ocsp","certificate","pki"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}