{"record":{"id":"8f00c8dbdf723a9a","repo":"XTLS/Xray-core","slug":"no-issuing-certificate-url","errorCode":null,"errorMessage":"no issuing certificate URL","messagePattern":"no issuing certificate URL","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/ocsp/ocsp.go","lineNumber":71,"sourceCode":"\tfor _, derBytes := range cert {\n\t\terr := pem.Encode(bundle, &pem.Block{Type: \"CERTIFICATE\", Bytes: derBytes})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tpemBundle := bundle.Bytes()\n\n\tcertificates, err := parsePEMBundle(pemBundle)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tissuedCert := certificates[0]\n\tif len(issuedCert.OCSPServer) == 0 {\n\t\treturn nil, errors.New(\"no OCSP server specified in cert\")\n\t}\n\tif len(certificates) == 1 {\n\t\tif len(issuedCert.IssuingCertificateURL) == 0 {\n\t\t\treturn nil, errors.New(\"no issuing certificate URL\")\n\t\t}\n\t\tresp, errC := http.Get(issuedCert.IssuingCertificateURL[0])\n\t\tif errC != nil {\n\t\t\treturn nil, errors.New(\"no issuing certificate URL\")\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tissuerBytes, errC := io.ReadAll(resp.Body)\n\t\tif errC != nil {\n\t\t\treturn nil, errors.New(errC)\n\t\t}\n\n\t\tissuerCert, errC := x509.ParseCertificate(issuerBytes)\n\t\tif errC != nil {\n\t\t\treturn nil, errors.New(errC)\n\t\t}\n\n\t\tcertificates = append(certificates, issuerCert)","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/ocsp/ocsp.go#L53-L89","documentation":"Returned when the bundle contains only the leaf certificate and it has no IssuingCertificateURL (AIA 'CA Issuers' field). The OCSP request needs the issuer certificate to compute the issuer key hash, so with neither a bundled issuer nor a fetch URL the lookup is impossible.","triggerScenarios":"Supplying a single PEM certificate (leaf only) whose AIA extension lacks the caIssuers URI, i.e. len(certificates) == 1 and len(issuedCert.IssuingCertificateURL) == 0.","commonSituations":"Self-signed certificates, private CAs that omit AIA, or ops pipelines that strip the intermediate/issuer cert from the served bundle.","solutions":["Include the issuer/intermediate certificate in the PEM bundle so len(certificates) > 1","Reissue the cert with an AIA 'CA Issuers' URI pointing at the issuer DER","Disable OCSP checking for certificate chains that intentionally omit AIA"],"exampleFix":"# before (served bundle)\n-----BEGIN CERTIFICATE-----\nleaf...\n-----END CERTIFICATE-----\n\n# after (bundle leaf + intermediate)\n-----BEGIN CERTIFICATE-----\nleaf...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nintermediate...\n-----END CERTIFICATE-----","handlingStrategy":"validation","validationCode":"if len(certs) == 1 && len(certs[0].IssuingCertificateURL) == 0 {\n    return errors.New(\"bundle must include issuer or cert needs AIA caIssuers URI\")\n}","typeGuard":"func hasIssuerAvailable(certs []*x509.Certificate) bool {\n    return len(certs) > 1 || len(certs[0].IssuingCertificateURL) > 0\n}","tryCatchPattern":null,"preventionTips":["Always serve leaf + intermediate bundles","Include AIA fields when issuing enterprise certs"],"tags":["tls","ocsp","certificate","pki"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}