nats-io/nats-server · error

bad OCSP responder http status: [%d]

Error message

bad OCSP responder http status: [%d]

What it means

OCSP responder fetch: the HTTP request to the OCSP responder URL succeeded at the transport level but returned a status other than 200 OK, so the response body is not a usable OCSP response.

Source

Thrown at server/certidp/ocsp_responder.go:46

func FetchOCSPResponse(link *ChainLink, opts *OCSPPeerConfig, log *Log) ([]byte, error) {
	if link == nil || link.Leaf == nil || link.Issuer == nil || opts == nil || log == nil {
		return nil, errors.New(ErrInvalidChainlink)
	}

	timeout := time.Duration(opts.Timeout * float64(time.Second))
	if timeout <= 0*time.Second {
		timeout = DefaultOCSPResponderTimeout
	}

	getRequestBytes := func(u string, hc *http.Client) ([]byte, error) {
		resp, err := hc.Get(u)
		if err != nil {
			return nil, err
		}
		defer resp.Body.Close()
		if resp.StatusCode != http.StatusOK {
			return nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)
		}
		return io.ReadAll(resp.Body)
	}

	// Request documentation:
	// https://tools.ietf.org/html/rfc6960#appendix-A.1

	reqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)
	if err != nil {
		return nil, err
	}

	reqEnc := encodeOCSPRequest(reqDER)

	responders := *link.OCSPWebEndpoints

	if len(responders) == 0 {
		return nil, errors.New(ErrNoAvailOCSPServers)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the OCSP responder URL and reachability
2. Verify the responder expects GET with base64/URL-encoded requests
3. Point certidp at a healthy responder or fix responder-side errors indicated by the status code

When it happens

Trigger: Thrown at server/certidp/ocsp_responder.go:46 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/68ddd215a2d900a1. Report an issue: GitHub.