{"record":{"id":"bf6f761eae52e0ee","repo":"nats-io/nats-server","slug":"unable-to-plug-tls-verify-connection-config-is-ni","errorCode":null,"errorMessage":"unable to plug TLS verify connection, config is nil","messagePattern":"unable to plug TLS verify connection, config is nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp_peer.go","lineNumber":140,"sourceCode":"\t\t\tpcfg.AllowWhenCAUnreachable = allowWhenCAUnreachable\n\t\tdefault:\n\t\t\treturn nil, &configErr{tk, fmt.Sprintf(certidp.ErrParsingPeerOptFieldGeneric, mk)}\n\t\t}\n\t}\n\treturn pcfg, nil\n}\n\nfunc peerFromVerifiedChains(chains [][]*x509.Certificate) *x509.Certificate {\n\tif len(chains) == 0 || len(chains[0]) == 0 {\n\t\treturn nil\n\t}\n\treturn chains[0][0]\n}\n\n// plugTLSOCSPPeer will plug the TLS handshake lifecycle for client mTLS connections and Leaf connections\nfunc (s *Server) plugTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {\n\tif config == nil || config.tlsConfig == nil {\n\t\treturn nil, false, errors.New(certidp.ErrUnableToPlugTLSEmptyConfig)\n\t}\n\tkind := config.kind\n\tisSpoke := config.isLeafSpoke\n\ttcOpts := config.tlsOpts\n\tif tcOpts == nil || tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {\n\t\treturn nil, false, nil\n\t}\n\ts.Debugf(certidp.DbgPlugTLSForKind, config.kind)\n\t// peer is a tls client\n\tif kind == kindStringMap[CLIENT] || (kind == kindStringMap[LEAF] && !isSpoke) {\n\t\tif !tcOpts.Verify {\n\t\t\treturn nil, false, errors.New(certidp.ErrMTLSRequired)\n\t\t}\n\t\treturn s.plugClientTLSOCSPPeer(config)\n\t}\n\t// peer is a tls server\n\tif kind == kindStringMap[LEAF] && isSpoke {\n\t\treturn s.plugServerTLSOCSPPeer(config)","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp_peer.go#L122-L158","documentation":"Raised in Server.plugTLSOCSPPeer (server/ocsp_peer.go:140) when the server tries to install OCSP peer-certificate verification hooks but the tlsConfigKind wrapper or its embedded *tls.Config is nil. OCSP stapling/verification for mTLS clients and leaf connections requires a fully constructed TLS config; without one there is nothing to plug the VerifyConnection callback into, so startup fails fast with certidp.ErrUnableToPlugTLSEmptyConfig.","triggerScenarios":"enableOCSP or reloadOCSP invokes plugTLSOCSPPeer with a nil config pointer, or a config whose tlsConfig field is nil — typically when OCSP peer verification (ocsp_peer config with verify: true) is enabled without a TLS config block defined for that kind (client or leaf).","commonSituations":"Setting ocsp_peer verify options in the config but omitting the tls {} block for clients or leaf nodes; a config reload that clears TLS settings while OCSP options remain; copy-pasting OCSP config into a section without TLS.","solutions":["Add a complete tls { cert_file, key_file, ca_file } configuration for the kind (clients and/or leaf) where OCSP peer verification is enabled","Ensure ocsp_peer verify options only appear under a section that also defines TLS","Re-run nats-server with the corrected config; if reloading, include both TLS and OCSP sections in the new config"],"exampleFix":"# before\nocsp_peers {\n  verify: true\n}\n# after: TLS must exist for the same kind\ntls {\n  cert_file: \"./server-cert.pem\"\n  key_file: \"./server-key.pem\"\n  ca_file: \"./ca.pem\"\n  verify: true\n}\nocsp_peer {\n  verify: true\n  urls: [\"http://ocsp.example.com\"]\n}","handlingStrategy":"validation","validationCode":"// validate the NATS config before startup:\n// every section with ocsp_peer { verify: true } must also define tls { cert_file, key_file }\nimport yaml\ncfg = yaml.safe_load(open('nats.conf'))\ndef check(section, name):\n    tls = section.get('tls') or {}\n    ocsp = (tls.get('ocsp_peer') or {})\n    if ocsp.get('verify') and not tls.get('cert_file'):\n        raise SystemExit(f'{name}: ocsp_peer.verify requires a full tls block')\nfor s in ('clients', 'leafnodes'):\n    if s in cfg: check(cfg[s], s)","typeGuard":null,"tryCatchPattern":"// Go: fail fast with a clear message when starting the server\nif err := startServer(cfgPath); err != nil && strings.Contains(err.Error(), \"unable to plug TLS verify connection, config is nil\") {\n    log.Fatalf(\"OCSP peer verification enabled but TLS config missing for this kind: %v\", err)\n}","preventionTips":["Always colocate ocsp_peer settings inside the tls block they apply to","Run `nats-server -t` (config test) after editing TLS/OCSP config","Keep client and leaf TLS blocks symmetrical when enabling OCSP peer verification"],"tags":["tls","ocsp","config","nats-server"],"backgroundTag":"missing-tls-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}