{"record":{"id":"fa31ecda2259d4ce","repo":"nats-io/nats-server","slug":"store-dir-not-set","errorCode":null,"errorMessage":"store_dir not set","messagePattern":"store_dir not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":129,"sourceCode":"\traw, resp, err = oc.getLocalStatus()\n\tif err == nil {\n\t\treturn raw, resp, nil\n\t}\n\n\treturn oc.getRemoteStatus()\n}\n\nfunc (oc *OCSPMonitor) getCacheStatus() ([]byte, *ocsp.Response) {\n\toc.mu.Lock()\n\tdefer oc.mu.Unlock()\n\treturn oc.raw, oc.resp\n}\n\nfunc (oc *OCSPMonitor) getLocalStatus() ([]byte, *ocsp.Response, error) {\n\topts := oc.srv.getOpts()\n\tstoreDir := opts.StoreDir\n\tif storeDir == _EMPTY_ {\n\t\treturn nil, nil, fmt.Errorf(\"store_dir not set\")\n\t}\n\n\t// This key must be based upon the current full certificate, not the public key,\n\t// so MUST be on the full raw certificate and not an SPKI or other reduced form.\n\tkey := fmt.Sprintf(\"%x\", sha256.Sum256(oc.Leaf.Raw))\n\n\toc.mu.Lock()\n\traw, err := os.ReadFile(filepath.Join(storeDir, defaultOCSPStoreDir, key))\n\toc.mu.Unlock()\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tresp, err := ocsp.ParseResponse(raw, oc.Issuer)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to get local status: %w\", err)\n\t}\n\tif err := validOCSPResponse(resp); err != nil {","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L111-L147","documentation":"OCSPMonitor.getLocalStatus guard: reading the cached OCSP response from disk requires a persistent store directory, but the server's StoreDir option is empty (no JetStore/data dir configured), so local OCSP status lookup is impossible.","triggerScenarios":"Thrown at server/ocsp.go:129 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure a store_dir for the server so OCSP responses can be cached locally","Rely on remote OCSP responder status, which is what the caller falls back to"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}