{"record":{"id":"8bb9e49a07168eaf","repo":"nats-io/nats-server","slug":"invalid-ocsp-thisupdate-is-future-time-s","errorCode":null,"errorMessage":"invalid ocsp ThisUpdate, is future time: %s","messagePattern":"invalid ocsp ThisUpdate, is future time: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":993,"sourceCode":"\tcase ocsp.Good:\n\t\treturn \"good\"\n\tcase ocsp.Revoked:\n\t\treturn \"revoked\"\n\tdefault:\n\t\treturn \"unknown\"\n\t}\n}\n\nfunc validOCSPResponse(r *ocsp.Response) error {\n\t// Time validation not handled by ParseResponse.\n\t// https://tools.ietf.org/html/rfc6960#section-4.2.2.1\n\tif !r.NextUpdate.IsZero() && r.NextUpdate.Before(time.Now()) {\n\t\tt := r.NextUpdate.Format(time.RFC3339Nano)\n\t\treturn fmt.Errorf(\"invalid ocsp NextUpdate, is past time: %s\", t)\n\t}\n\tif r.ThisUpdate.After(time.Now()) {\n\t\tt := r.ThisUpdate.Format(time.RFC3339Nano)\n\t\treturn fmt.Errorf(\"invalid ocsp ThisUpdate, is future time: %s\", t)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":975,"sourceCodeEnd":998,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L975-L998","documentation":"validOCSPResponse also rejects responses whose ThisUpdate timestamp is in the future — the responder claims the status was produced at a later time, indicating clock skew or a malicious/broken responder per RFC 6960.","triggerScenarios":"validOCSPResponse receives a response where r.ThisUpdate.After(time.Now()) is true.","commonSituations":"NATS host clock behind the OCSP responder's clock, misconfigured responder issuing responses with future ThisUpdate, or time zone handling bugs when responders stamp times.","solutions":["Sync the NATS server clock via NTP (`timedatectl set-ntp true`)","Compare clocks with the responder host; escalate to the CA operator if the responder is at fault","Reject/refresh the response and re-query the responder"],"exampleFix":"// before: server clock 2h behind, responses appear future-dated\n# fix clock sync\n// after\ntimedatectl set-ntp true && chronyc makestep","handlingStrategy":"retry","validationCode":"if resp.ThisUpdate.After(time.Now()) { refetchOCSP(cert) }","typeGuard":null,"tryCatchPattern":"if verr := validOCSPResponse(resp); verr != nil {\n    if strings.Contains(verr.Error(), \"ThisUpdate, is future\") {\n        // suspect clock skew: refetch after syncing time\n        resp, err = fetchFresh(cert)\n    }\n}","preventionTips":["Keep server clocks NTP-synced","Verify responder health when many future-dated responses appear","Alert on ThisUpdate timestamps drifting into the future"],"tags":["ocsp","time-validation","clock-skew","rfc6960"],"backgroundTag":"ocsp-response-expired","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}