{"record":{"id":"a98e23b51e75c40a","repo":"nats-io/nats-server","slug":"exhausted-ocsp-servers-w","errorCode":null,"errorMessage":"exhausted ocsp servers: %w","messagePattern":"exhausted ocsp servers: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":247,"sourceCode":"\t\tu = strings.TrimSuffix(u, \"/\")\n\t\t// Prefer to make POST requests first.\n\t\traw, postErr = postRequestBytes(u, reqDER, hc)\n\t\tif postErr == nil {\n\t\t\terr = nil\n\t\t\tbreak\n\t\t} else {\n\t\t\t// Fallback to use a GET request.\n\t\t\traw, getErr = getRequestBytes(u, reqDER, hc)\n\t\t\tif getErr == nil {\n\t\t\t\terr = nil\n\t\t\t\tbreak\n\t\t\t} else {\n\t\t\t\terr = errors.Join(postErr, getErr)\n\t\t\t}\n\t\t}\n\t}\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"exhausted ocsp servers: %w\", err)\n\t}\n\tresp, err := ocsp.ParseResponse(raw, oc.Issuer)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to get remote status: %w\", err)\n\t}\n\tif err := validOCSPResponse(resp); err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tif storeDir := opts.StoreDir; storeDir != _EMPTY_ {\n\t\tkey := fmt.Sprintf(\"%x\", sha256.Sum256(oc.Leaf.Raw))\n\t\tif err := oc.writeOCSPStatus(storeDir, key, raw); err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to write ocsp status: %w\", err)\n\t\t}\n\t}\n\n\toc.mu.Lock()\n\toc.raw = raw","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L229-L265","documentation":"getRemoteStatus: every configured OCSP responder failed for both POST and GET (all errors joined with errors.Join and wrapped). OCSP status could not be refreshed from any source; the monitor's next tick or shutdown-on-revoke policy decides what happens next.","triggerScenarios":"Thrown at server/ocsp.go:247 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the joined inner errors to see which responders failed and why","Restore network access to at least one OCSP responder","Add a reachable OCSP override URL"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}