nats-io/nats-server · error

bad OCSP status update for certificate at '%s': %s

Error message

bad OCSP status update for certificate at '%s': %s

What it means

NewOCSPMonitor: the initial getStatus() call (memory, then local cache, then remote responders) failed while bootstrapping the OCSP monitor for the given cert file, so stapling cannot start. The underlying error string is embedded.

Source

Thrown at server/ocsp.go:457

		issuer, err := getOCSPIssuer(caFile, cert.Certificate)
		if err != nil {
			return nil, nil, err
		}

		mon = &OCSPMonitor{
			kind:             kind,
			srv:              srv,
			hc:               &http.Client{Timeout: 30 * time.Second},
			shutdownOnRevoke: shutdownOnRevoke,
			certFile:         certFile,
			stopCh:           make(chan struct{}, 1),
			Leaf:             cert.Leaf,
			Issuer:           issuer,
		}

		// Get the certificate status from the memory, then remote OCSP responder.
		if _, resp, err := mon.getStatus(); err != nil {
			return nil, nil, fmt.Errorf("bad OCSP status update for certificate at '%s': %s", certFile, err)
		} else if resp != nil && resp.Status != ocsp.Good && shutdownOnRevoke {
			return nil, nil, fmt.Errorf("found existing OCSP status for certificate at '%s': %s", certFile, ocspStatusString(resp.Status))
		}

		// Callbacks below will be in charge of returning the certificate instead,
		// so this has to be nil.
		tc.Certificates = nil

		// GetCertificate returns a certificate that's presented to a client.
		tc.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
			ccert := cert
			raw, _, err := mon.getStatus()
			if err != nil {
				return nil, err
			}
			return &tls.Certificate{
				OCSPStaple:                   raw,
				Certificate:                  ccert.Certificate,

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Inspect the embedded cause (responder unreachable, cache corrupt, parse error) and fix it
2. Ensure network access to OCSP responders at startup
3. Retry server start after transient OCSP outages clear

When it happens

Trigger: Thrown at server/ocsp.go:457 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/f73da477313de5bb. Report an issue: GitHub.