nats-io/nats-server · error

failed to get local status: %w

Error message

failed to get local status: %w

What it means

Wrap produced in getLocalStatus when the cached OCSP bytes read from disk cannot be parsed by ocsp.ParseResponse (corrupted cache file, truncated write, or wrong issuer). The getStatus caller treats it as a cache miss and falls back to the remote responder.

Source

Thrown at server/ocsp.go:145

	storeDir := opts.StoreDir
	if storeDir == _EMPTY_ {
		return nil, nil, fmt.Errorf("store_dir not set")
	}

	// This key must be based upon the current full certificate, not the public key,
	// so MUST be on the full raw certificate and not an SPKI or other reduced form.
	key := fmt.Sprintf("%x", sha256.Sum256(oc.Leaf.Raw))

	oc.mu.Lock()
	raw, err := os.ReadFile(filepath.Join(storeDir, defaultOCSPStoreDir, key))
	oc.mu.Unlock()
	if err != nil {
		return nil, nil, err
	}

	resp, err := ocsp.ParseResponse(raw, oc.Issuer)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get local status: %w", err)
	}
	if err := validOCSPResponse(resp); err != nil {
		return nil, nil, err
	}

	// Cache the response.
	oc.mu.Lock()
	oc.raw = raw
	oc.resp = resp
	oc.mu.Unlock()

	return raw, resp, nil
}

func (oc *OCSPMonitor) getRemoteStatus() ([]byte, *ocsp.Response, error) {
	opts := oc.srv.getOpts()
	var overrideURLs []string
	if config := opts.OCSPConfig; config != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Let the monitor refresh the staple from the remote OCSP responder (automatic fallback)
2. Delete the corrupted cache file under <store_dir>/jetstream/ocsp if stale entries persist

When it happens

Trigger: Thrown at server/ocsp.go:145 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/3d523f38de49f12f. Report an issue: GitHub.