{"record":{"id":"f2a241d16b447f83","repo":"nats-io/nats-server","slug":"ocsp-staple-s-signer-missing-authorization-by-ca-t","errorCode":null,"errorMessage":"OCSP staple's signer missing authorization by CA to act as OCSP signer","messagePattern":"OCSP staple's signer missing authorization by CA to act as OCSP signer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":520,"sourceCode":"\t\t\t\t}\n\n\t\t\t\t// Response signature of issuer or issuer delegate is checked in the library parse\n\t\t\t\tresp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse OCSP response from %s peer: %w\", kind, err)\n\t\t\t\t}\n\n\t\t\t\t// If signer was issuer delegate double-check issuer delegate authorization\n\t\t\t\tif resp.Certificate != nil {\n\t\t\t\t\tok := false\n\t\t\t\t\tfor _, eku := range resp.Certificate.ExtKeyUsage {\n\t\t\t\t\t\tif eku == x509.ExtKeyUsageOCSPSigning {\n\t\t\t\t\t\t\tok = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif !ok {\n\t\t\t\t\t\treturn fmt.Errorf(\"OCSP staple's signer missing authorization by CA to act as OCSP signer\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Check that the OCSP response is effective, take defaults for clockskew and default validity\n\t\t\t\tpeerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}\n\t\t\t\tsLog := certidp.Log{Debugf: srv.Debugf}\n\t\t\t\tif !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {\n\t\t\t\t\treturn fmt.Errorf(\"OCSP staple from %s peer not current\", kind)\n\t\t\t\t}\n\n\t\t\t\tif resp.Status != ocsp.Good {\n\t\t\t\t\treturn fmt.Errorf(\"bad status for OCSP Staple from %s peer: %s\", kind, ocspStatusString(resp.Status))\n\t\t\t\t}\n\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\t// When server makes a peer connection, need to also present an OCSP Staple.","sourceCodeStart":502,"sourceCodeEnd":538,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L502-L538","documentation":"Peer-verification callback: the OCSP response was signed by a delegate certificate, but that delegate lacks the OCSPSigning extended key usage, so it is not authorized by the CA to act as an OCSP signer.","triggerScenarios":"Thrown at server/ocsp.go:520 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Have the CA issue the responder delegate a cert with the OCSPSigning EKU","Use a responder signed directly by the issuer CA"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}