nats-io/nats-server · error

exhausted OCSP responders: %w

Error message

exhausted OCSP responders: %w

What it means

All configured/defaulted OCSP responder URLs were tried in sequence and every getRequestBytes call failed (network error or non-200); the last error is wrapped and reported as exhaustion of the responder list.

Source

Thrown at server/certidp/ocsp_responder.go:81

	if len(responders) == 0 {
		return nil, errors.New(ErrNoAvailOCSPServers)
	}

	var raw []byte
	hc := &http.Client{
		Timeout: timeout,
	}
	for _, u := range responders {
		responderURL := u.String()
		log.Debugf(DbgMakingCARequest, responderURL)
		responderURL = strings.TrimSuffix(responderURL, "/")
		raw, err = getRequestBytes(fmt.Sprintf("%s/%s", responderURL, reqEnc), hc)
		if err == nil {
			break
		}
	}
	if err != nil {
		return nil, fmt.Errorf(ErrFailedWithAllRequests, err)
	}

	return raw, nil
}

// encodeOCSPRequest encodes the OCSP request in base64 and URL-encodes it.
// This is needed to fulfill the OCSP responder's requirements for the request format. (X.690)
func encodeOCSPRequest(reqDER []byte) string {
	reqEnc := base64.StdEncoding.EncodeToString(reqDER)
	return url.QueryEscape(reqEnc)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Restore connectivity to at least one OCSP responder
2. Verify responder URLs in the AIA extension or configured peers
3. Check TLS/firewall settings blocking the responder requests

When it happens

Trigger: Thrown at server/certidp/ocsp_responder.go:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/0d9012aa7dcc9092. Report an issue: GitHub.