{"record":{"id":"fa0e14e24b5bf18f","repo":"nats-io/nats-server","slug":"failed-to-parse-cert-v","errorCode":null,"errorMessage":"failed to parse cert: %v","messagePattern":"failed to parse cert: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":957,"sourceCode":"\tvar trustedCAs []*x509.Certificate\n\tvar certBundle []*x509.Certificate\n\tvar err error\n\n\t// FIXME(tgb): extend if pluggable CA store provider added to NATS (i.e. other than PEM file)\n\n\t// Non-system default CA trust store passed\n\tif caFile != _EMPTY_ {\n\t\ttrustedCAs, err = parseCertPEM(caFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse ca_file: %v\", err)\n\t\t}\n\t}\n\n\t// Specify bundled intermediate CA store\n\tfor _, certBytes := range chain {\n\t\tcert, err := x509.ParseCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse cert: %v\", err)\n\t\t}\n\t\tcertBundle = append(certBundle, cert)\n\t}\n\n\tissuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)\n\tif err != nil || issuer == nil {\n\t\treturn nil, fmt.Errorf(\"no issuers found\")\n\t}\n\n\tif !issuer.IsCA {\n\t\treturn nil, fmt.Errorf(\"%s invalid ca basic constraints: is not ca\", issuer.Subject)\n\t}\n\treturn issuer, nil\n}\n\nfunc ocspStatusString(n int) string {\n\tswitch n {\n\tcase ocsp.Good:","sourceCodeStart":939,"sourceCodeEnd":975,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L939-L975","documentation":"After the CA file, getOCSPIssuer parses each raw certificate in the provided chain with x509.ParseCertificate. A chain entry that is not a valid DER-encoded X.509 certificate aborts startup of the OCSP monitor with this wrapped error.","triggerScenarios":"NewOCSPMonitor called with a chain slice containing bytes that fail x509.ParseCertificate (empty entries, TLS handshake leftovers, malformed DER).","commonSituations":"Chain bytes harvested incorrectly from tls.ConnectionState (indexing PeerCertificates wrong), or a corrupted/hand-edited bundle file.","solutions":["Build the chain from tls.ConnectionState().PeerCertificates instead of raw byte slices","Validate each file's certs with `openssl crl2pkcs7 -nocrl -certfile bundle.pem | openssl pkcs7 -print_certs -noout`","Remove any non-certificate text (keys, garbage) from the bundle file"],"exampleFix":"// before\nchain := [][]byte{ rawFileBytes }  // not per-cert DER\n// after\nchain := [][]byte{}\nfor _, c := range conn.PeerCertificates { chain = append(chain, c.Raw) }","handlingStrategy":"validation","validationCode":"for i, raw := range chain {\n    if _, err := x509.ParseCertificate(raw); err != nil {\n        return fmt.Errorf(\"chain[%d] is not a valid DER cert: %w\", i, err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Populate chain from tls.ConnectionState().PeerCertificates Raw fields","Never store non-der bytes in chain slices","Dump and inspect the chain when debugging OCSP startup"],"tags":["tls","ocsp","x509","certificate-parsing"],"backgroundTag":"invalid-certificate-format","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}