{"record":{"id":"bb02bc954a912ee1","repo":"nats-io/nats-server","slug":"no-issuers-found","errorCode":null,"errorMessage":"no issuers found","messagePattern":"no issuers found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":964,"sourceCode":"\tif caFile != _EMPTY_ {\n\t\ttrustedCAs, err = parseCertPEM(caFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse ca_file: %v\", err)\n\t\t}\n\t}\n\n\t// Specify bundled intermediate CA store\n\tfor _, certBytes := range chain {\n\t\tcert, err := x509.ParseCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse cert: %v\", err)\n\t\t}\n\t\tcertBundle = append(certBundle, cert)\n\t}\n\n\tissuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)\n\tif err != nil || issuer == nil {\n\t\treturn nil, fmt.Errorf(\"no issuers found\")\n\t}\n\n\tif !issuer.IsCA {\n\t\treturn nil, fmt.Errorf(\"%s invalid ca basic constraints: is not ca\", issuer.Subject)\n\t}\n\treturn issuer, nil\n}\n\nfunc ocspStatusString(n int) string {\n\tswitch n {\n\tcase ocsp.Good:\n\t\treturn \"good\"\n\tcase ocsp.Revoked:\n\t\treturn \"revoked\"\n\tdefault:\n\t\treturn \"unknown\"\n\t}\n}","sourceCodeStart":946,"sourceCodeEnd":982,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L946-L982","documentation":"If the CA file and bundle produce no usable issuer (getOCSPIssuerLocally returns nil issuer without error — e.g. no trusted CA matched the leaf and no explicit issuer was in the bundle), getOCSPIssuer fails with \"no issuers found\".","triggerScenarios":"getOCSPIssuerLocally returns (nil, nil): the leaf's issuer is not found among trustedCAs (when a CA pool was supplied) and certBundle has no second certificate.","commonSituations":"ca_file lists a root CA but the leaf is signed by an intermediate not present in the bundle; operator relies on the system trust store but the real issuer is missing; bundle contains only the leaf.","solutions":["Add the leaf's direct issuer (intermediate) as the second certificate in the cert bundle","Ensure ca_file contains the CA that actually signed the leaf","Omit ca_file to use the system default trust store if the chain is publicly trusted"],"exampleFix":"// before\n# bundle: leaf only, ca_file = root that did not sign leaf\n// after\ncat leaf.pem intermediate.pem > bundle.pem\n# or set ca_file to the intermediate that signed the leaf","handlingStrategy":"validation","validationCode":"leaf := bundle[0]\n// ensure the direct issuer is available before enabling OCSP\nif len(bundle) < 2 && trustedCAs == nil { return errors.New(\"provide the leaf's issuer in bundle or ca_file\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include the full chain (leaf + intermediates), not just the leaf","Point ca_file at the CA that actually signed the leaf","Verify chain completeness with `openssl verify -show_chain`"],"tags":["ocsp","tls","certificate-chain","configuration"],"backgroundTag":"ocsp-issuer-not-found","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}