nats-io/nats-server · error

failed to parse ca_file: %v

Error message

failed to parse ca_file: %v

What it means

The OCSP monitor's trusted CA pool is built by parseCertPEM on the configured ca_file. If the PEM file cannot be parsed into x509 certificates (bad format, non-cert PEM blocks, unreadable/corrupt content), the error is wrapped as "failed to parse ca_file".

Source

Thrown at server/ocsp.go:949

	}

	return certstore.GetLeafIssuer(leaf, vOpts), nil
}

// getOCSPIssuer determines an issuer certificate from the cert (bundle) or the file-based CA trust store
func getOCSPIssuer(caFile string, chain [][]byte) (*x509.Certificate, error) {
	var issuer *x509.Certificate
	var trustedCAs []*x509.Certificate
	var certBundle []*x509.Certificate
	var err error

	// FIXME(tgb): extend if pluggable CA store provider added to NATS (i.e. other than PEM file)

	// Non-system default CA trust store passed
	if caFile != _EMPTY_ {
		trustedCAs, err = parseCertPEM(caFile)
		if err != nil {
			return nil, fmt.Errorf("failed to parse ca_file: %v", err)
		}
	}

	// Specify bundled intermediate CA store
	for _, certBytes := range chain {
		cert, err := x509.ParseCertificate(certBytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse cert: %v", err)
		}
		certBundle = append(certBundle, cert)
	}

	issuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)
	if err != nil || issuer == nil {
		return nil, fmt.Errorf("no issuers found")
	}

	if !issuer.IsCA {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Validate the file with `openssl x509 -in ca.pem -text -noout` before configuring it
2. Convert DER to PEM if needed: `openssl x509 -inform der -in ca.der -out ca.pem`
3. Check file permissions/readability for the NATS process user

Example fix

// before
ocsp: { ca_file: /etc/nats/ca.der }  // DER binary
// after
openssl x509 -inform der -in ca.der -out ca.pem
# nats.conf
ocsp: { ca_file: /etc/nats/ca.pem }

data, err := os.ReadFile(caFile)
if err != nil { return err }
if _, err := x509.ParseCertificates(pemBytesOf(data)); err != nil { return fmt.Errorf("ca_file invalid: %w", err) }

When it happens

Trigger: NewOCSPMonitor invoked with a non-empty ca_file where parseCertPEM(caFile) returns any error (empty PEM, invalid base64, unexpected block types, zero certificates).

Common situations: ca_file path typo leading to empty/garbage file, file containing DER (binary) instead of PEM, file with only a private key, or truncated file after transfer.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unexpected PEM certificate type: %s
• invalid ocsp ca configuration
• no issuers found
• invalid chain link
• no available OCSP servers

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/56ba5336ca9631a9. Report an issue: GitHub.