nats-io/nats-server · error

bad status for OCSP Staple from %s peer: %s

Error message

bad status for OCSP Staple from %s peer: %s

What it means

Peer-verification callback: the staple parsed and was current, but resp.Status is not good (e.g. revoked or unknown), so the peer's certificate status is unacceptable and the TLS handshake fails.

Source

Thrown at server/ocsp.go:532

						if eku == x509.ExtKeyUsageOCSPSigning {
							ok = true
							break
						}
					}
					if !ok {
						return fmt.Errorf("OCSP staple's signer missing authorization by CA to act as OCSP signer")
					}
				}

				// Check that the OCSP response is effective, take defaults for clockskew and default validity
				peerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}
				sLog := certidp.Log{Debugf: srv.Debugf}
				if !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {
					return fmt.Errorf("OCSP staple from %s peer not current", kind)
				}

				if resp.Status != ocsp.Good {
					return fmt.Errorf("bad status for OCSP Staple from %s peer: %s", kind, ocspStatusString(resp.Status))
				}

				return nil
			}

			// When server makes a peer connection, need to also present an OCSP Staple.
			tc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
				ccert := cert
				raw, _, err := mon.getStatus()
				if err != nil {
					return nil, err
				}
				// NOTE: crypto/tls.sendClientCertificate internally also calls getClientCertificate
				// so if for some reason these callbacks are triggered concurrently during a reconnect
				// there can be a race. To avoid that, the OCSP monitor lock is used to serialize access
				// to the staple which could also change inflight during an update.
				mon.mu.Lock()
				ccert.OCSPStaple = raw

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Investigate why the peer certificate is revoked/unknown at its CA
2. Reissue the peer certificate if the revocation was expected

When it happens

Trigger: Thrown at server/ocsp.go:532 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/758871edc812e672. Report an issue: GitHub.