nats-io/nats-server · error

failed to get issuer certificate for %s peer

Error message

failed to get issuer certificate for %s peer

What it means

Peer-verification callback: no issuer certificate could be located in the peer's verified chain (certidp.GetLeafIssuerCert returned nil), so the OCSP response signature cannot be validated against an issuer.

Source

Thrown at server/ocsp.go:501

		// Check whether need to verify staples from a peer router or gateway connection.
		switch kind {
		case kindStringMap[ROUTER], kindStringMap[GATEWAY]:
			tc.VerifyConnection = func(s tls.ConnectionState) error {
				oresp := s.OCSPResponse
				if oresp == nil {
					return fmt.Errorf("%s peer missing OCSP Staple", kind)
				}

				// Peer connections will verify the response of the staple.
				if len(s.VerifiedChains) == 0 {
					return fmt.Errorf("%s peer missing TLS verified chains", kind)
				}

				chain := s.VerifiedChains[0]
				peerLeaf := chain[0]
				peerIssuer := certidp.GetLeafIssuerCert(chain, 0)
				if peerIssuer == nil {
					return fmt.Errorf("failed to get issuer certificate for %s peer", kind)
				}

				// Response signature of issuer or issuer delegate is checked in the library parse
				resp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)
				if err != nil {
					return fmt.Errorf("failed to parse OCSP response from %s peer: %w", kind, err)
				}

				// If signer was issuer delegate double-check issuer delegate authorization
				if resp.Certificate != nil {
					ok := false
					for _, eku := range resp.Certificate.ExtKeyUsage {
						if eku == x509.ExtKeyUsageOCSPSigning {
							ok = true
							break
						}
					}
					if !ok {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Have the peer send its intermediate certificates so the issuer is in the chain
2. Adjust trust settings so the full chain is available for verification

When it happens

Trigger: Thrown at server/ocsp.go:501 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/8687333db6ce4a47. Report an issue: GitHub.