{"record":{"id":"b440e8cbe3a14e3f","repo":"nats-io/nats-server","slug":"ocsp-staple-from-s-peer-not-current","errorCode":null,"errorMessage":"OCSP staple from %s peer not current","messagePattern":"OCSP staple from (.+?) peer not current","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":528,"sourceCode":"\t\t\t\t// If signer was issuer delegate double-check issuer delegate authorization\n\t\t\t\tif resp.Certificate != nil {\n\t\t\t\t\tok := false\n\t\t\t\t\tfor _, eku := range resp.Certificate.ExtKeyUsage {\n\t\t\t\t\t\tif eku == x509.ExtKeyUsageOCSPSigning {\n\t\t\t\t\t\t\tok = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif !ok {\n\t\t\t\t\t\treturn fmt.Errorf(\"OCSP staple's signer missing authorization by CA to act as OCSP signer\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Check that the OCSP response is effective, take defaults for clockskew and default validity\n\t\t\t\tpeerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}\n\t\t\t\tsLog := certidp.Log{Debugf: srv.Debugf}\n\t\t\t\tif !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {\n\t\t\t\t\treturn fmt.Errorf(\"OCSP staple from %s peer not current\", kind)\n\t\t\t\t}\n\n\t\t\t\tif resp.Status != ocsp.Good {\n\t\t\t\t\treturn fmt.Errorf(\"bad status for OCSP Staple from %s peer: %s\", kind, ocspStatusString(resp.Status))\n\t\t\t\t}\n\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\t// When server makes a peer connection, need to also present an OCSP Staple.\n\t\t\ttc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {\n\t\t\t\tccert := cert\n\t\t\t\traw, _, err := mon.getStatus()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\t// NOTE: crypto/tls.sendClientCertificate internally also calls getClientCertificate\n\t\t\t\t// so if for some reason these callbacks are triggered concurrently during a reconnect","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L510-L546","documentation":"Peer-verification callback: certidp.OCSPResponseCurrent reported the staple as not currently valid (outside its thisUpdate/nextUpdate window, with default clock-skew and unset-next-update policy). The peer is offering a stale OCSP staple.","triggerScenarios":"Thrown at server/ocsp.go:528 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Have the peer refresh its staple from the OCSP responder","Verify the peer's and this server's clocks are sane"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}