nats-io/nats-server · error

failed to get remote status: %w

Error message

failed to get remote status: %w

What it means

getRemoteStatus: a responder returned bytes, but ocsp.ParseResponse could not parse them as a valid OCSP response signed by the known issuer (malformed body, wrong signer, or encoding issue).

Source

Thrown at server/ocsp.go:251

			err = nil
			break
		} else {
			// Fallback to use a GET request.
			raw, getErr = getRequestBytes(u, reqDER, hc)
			if getErr == nil {
				err = nil
				break
			} else {
				err = errors.Join(postErr, getErr)
			}
		}
	}
	if err != nil {
		return nil, nil, fmt.Errorf("exhausted ocsp servers: %w", err)
	}
	resp, err := ocsp.ParseResponse(raw, oc.Issuer)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get remote status: %w", err)
	}
	if err := validOCSPResponse(resp); err != nil {
		return nil, nil, err
	}

	if storeDir := opts.StoreDir; storeDir != _EMPTY_ {
		key := fmt.Sprintf("%x", sha256.Sum256(oc.Leaf.Raw))
		if err := oc.writeOCSPStatus(storeDir, key, raw); err != nil {
			return nil, nil, fmt.Errorf("failed to write ocsp status: %w", err)
		}
	}

	oc.mu.Lock()
	oc.raw = raw
	oc.resp = resp
	oc.mu.Unlock()

	return raw, resp, nil

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Confirm the responder URL actually serves OCSP for this certificate's issuer
2. Retry on the next monitor tick; transient corruption is common
3. Point an override URL at the CA's canonical OCSP endpoint

When it happens

Trigger: Thrown at server/ocsp.go:251 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/bf7e1013a5f7032d. Report an issue: GitHub.