{"record":{"id":"e78a361c5b1d5b63","repo":"nats-io/nats-server","slug":"no-certificate-found","errorCode":null,"errorMessage":"no certificate found","messagePattern":"no certificate found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":399,"sourceCode":"\t\t\tcaFile = opts.TLSCaCert\n\t\t}\n\t}\n\tif tcOpts != nil {\n\t\tcertFile = tcOpts.CertFile\n\t\tcaFile = tcOpts.CaFile\n\t}\n\n\t// NOTE: Currently OCSP Stapling is enabled only for the first certificate found.\n\tvar mon *OCSPMonitor\n\tfor _, currentCert := range tc.Certificates {\n\t\t// Create local copy since this will be used in the GetCertificate callback.\n\t\tcert := currentCert\n\n\t\t// This is normally non-nil, but can still be nil here when in tests\n\t\t// or in some embedded scenarios.\n\t\tif cert.Leaf == nil {\n\t\t\tif len(cert.Certificate) <= 0 {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"no certificate found\")\n\t\t\t}\n\t\t\tvar err error\n\t\t\tcert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"error parsing certificate: %v\", err)\n\t\t\t}\n\t\t}\n\t\tvar shutdownOnRevoke bool\n\t\tmustStaple := hasOCSPStatusRequest(cert.Leaf)\n\t\tif oc != nil {\n\t\t\tswitch {\n\t\t\tcase oc.Mode == OCSPModeNever:\n\t\t\t\tif mustStaple {\n\t\t\t\t\tsrv.Warnf(\"Certificate at '%s' has MustStaple but OCSP is disabled\", certFile)\n\t\t\t\t}\n\t\t\t\treturn tc, nil, nil\n\t\t\tcase oc.Mode == OCSPModeAlways:\n\t\t\t\t// Start the monitor for this cert even if it does not have","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L381-L417","documentation":"NewOCSPMonitor guard: the tls.Certificate entry has no parsed Leaf and an empty Certificate chain, so there is no certificate material to build an OCSP monitor from. Occurs in tests or embedded setups that inject empty certificate slots.","triggerScenarios":"Thrown at server/ocsp.go:399 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a TLS certificate with at least one DER-encoded chain element","Skip OCSP monitoring for terminations that have no certificate"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}