nats-io/nats-server · error

exhausted ocsp servers: %w

Error message

exhausted ocsp servers: %w

What it means

getRemoteStatus: every configured OCSP responder failed for both POST and GET (all errors joined with errors.Join and wrapped). OCSP status could not be refreshed from any source; the monitor's next tick or shutdown-on-revoke policy decides what happens next.

Source

Thrown at server/ocsp.go:247

		u = strings.TrimSuffix(u, "/")
		// Prefer to make POST requests first.
		raw, postErr = postRequestBytes(u, reqDER, hc)
		if postErr == nil {
			err = nil
			break
		} else {
			// Fallback to use a GET request.
			raw, getErr = getRequestBytes(u, reqDER, hc)
			if getErr == nil {
				err = nil
				break
			} else {
				err = errors.Join(postErr, getErr)
			}
		}
	}
	if err != nil {
		return nil, nil, fmt.Errorf("exhausted ocsp servers: %w", err)
	}
	resp, err := ocsp.ParseResponse(raw, oc.Issuer)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get remote status: %w", err)
	}
	if err := validOCSPResponse(resp); err != nil {
		return nil, nil, err
	}

	if storeDir := opts.StoreDir; storeDir != _EMPTY_ {
		key := fmt.Sprintf("%x", sha256.Sum256(oc.Leaf.Raw))
		if err := oc.writeOCSPStatus(storeDir, key, raw); err != nil {
			return nil, nil, fmt.Errorf("failed to write ocsp status: %w", err)
		}
	}

	oc.mu.Lock()
	oc.raw = raw

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Inspect the joined inner errors to see which responders failed and why
2. Restore network access to at least one OCSP responder
3. Add a reachable OCSP override URL

When it happens

Trigger: Thrown at server/ocsp.go:247 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/a98e23b51e75c40a. Report an issue: GitHub.