{"record":{"id":"f73da477313de5bb","repo":"nats-io/nats-server","slug":"bad-ocsp-status-update-for-certificate-at-s-s","errorCode":null,"errorMessage":"bad OCSP status update for certificate at '%s': %s","messagePattern":"bad OCSP status update for certificate at '(.+?)': (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":457,"sourceCode":"\t\tissuer, err := getOCSPIssuer(caFile, cert.Certificate)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\n\t\tmon = &OCSPMonitor{\n\t\t\tkind:             kind,\n\t\t\tsrv:              srv,\n\t\t\thc:               &http.Client{Timeout: 30 * time.Second},\n\t\t\tshutdownOnRevoke: shutdownOnRevoke,\n\t\t\tcertFile:         certFile,\n\t\t\tstopCh:           make(chan struct{}, 1),\n\t\t\tLeaf:             cert.Leaf,\n\t\t\tIssuer:           issuer,\n\t\t}\n\n\t\t// Get the certificate status from the memory, then remote OCSP responder.\n\t\tif _, resp, err := mon.getStatus(); err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"bad OCSP status update for certificate at '%s': %s\", certFile, err)\n\t\t} else if resp != nil && resp.Status != ocsp.Good && shutdownOnRevoke {\n\t\t\treturn nil, nil, fmt.Errorf(\"found existing OCSP status for certificate at '%s': %s\", certFile, ocspStatusString(resp.Status))\n\t\t}\n\n\t\t// Callbacks below will be in charge of returning the certificate instead,\n\t\t// so this has to be nil.\n\t\ttc.Certificates = nil\n\n\t\t// GetCertificate returns a certificate that's presented to a client.\n\t\ttc.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {\n\t\t\tccert := cert\n\t\t\traw, _, err := mon.getStatus()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\treturn &tls.Certificate{\n\t\t\t\tOCSPStaple:                   raw,\n\t\t\t\tCertificate:                  ccert.Certificate,","sourceCodeStart":439,"sourceCodeEnd":475,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L439-L475","documentation":"NewOCSPMonitor: the initial getStatus() call (memory, then local cache, then remote responders) failed while bootstrapping the OCSP monitor for the given cert file, so stapling cannot start. The underlying error string is embedded.","triggerScenarios":"Thrown at server/ocsp.go:457 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the embedded cause (responder unreachable, cache corrupt, parse error) and fix it","Ensure network access to OCSP responders at startup","Retry server start after transient OCSP outages clear"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}