nats-io/nats-server · error

could not create OCSP storage directory - %v

Error message

could not create OCSP storage directory - %v

What it means

setupOCSPStapleStoreDir: the OCSP cache directory (<store_dir>/jetstream/ocsp) did not exist and os.MkdirAll failed (permissions, read-only filesystem, or a conflicting file path). The underlying mkdir error is included.

Source

Thrown at server/ocsp.go:574

			// GetClientCertificate returns a certificate that's presented to a server.
			tc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
				return &cert, nil
			}
		}
	}
	return tc, mon, nil
}

func (s *Server) setupOCSPStapleStoreDir() error {
	opts := s.getOpts()
	storeDir := opts.StoreDir
	if storeDir == _EMPTY_ {
		return nil
	}
	storeDir = filepath.Join(storeDir, defaultOCSPStoreDir)
	if stat, err := os.Stat(storeDir); os.IsNotExist(err) {
		if err := os.MkdirAll(storeDir, defaultDirPerms); err != nil {
			return fmt.Errorf("could not create OCSP storage directory - %v", err)
		}
	} else if stat == nil || !stat.IsDir() {
		return fmt.Errorf("OCSP storage directory is not a directory")
	}
	return nil
}

type tlsConfigKind struct {
	tlsConfig   *tls.Config
	tlsOpts     *TLSConfigOpts
	kind        string
	isLeafSpoke bool
	apply       func(*tls.Config)
}

func (s *Server) configureOCSP() []*tlsConfigKind {
	sopts := s.getOpts()

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix filesystem permissions on the store dir and retry startup
2. Ensure store_dir points to a writable location with no file/name collision

When it happens

Trigger: Thrown at server/ocsp.go:574 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/cd1abecd00d64226. Report an issue: GitHub.