nats-io/nats-server · error

found existing OCSP status for certificate at '%s': %s

Error message

found existing OCSP status for certificate at '%s': %s

What it means

NewOCSPMonitor: getStatus() returned an existing (cached) OCSP response whose status or validity is reported in this message during monitor bootstrap for the certificate. It surfaces the state of the pre-existing staple found for the cert file.

Source

Thrown at server/ocsp.go:459

			return nil, nil, err
		}

		mon = &OCSPMonitor{
			kind:             kind,
			srv:              srv,
			hc:               &http.Client{Timeout: 30 * time.Second},
			shutdownOnRevoke: shutdownOnRevoke,
			certFile:         certFile,
			stopCh:           make(chan struct{}, 1),
			Leaf:             cert.Leaf,
			Issuer:           issuer,
		}

		// Get the certificate status from the memory, then remote OCSP responder.
		if _, resp, err := mon.getStatus(); err != nil {
			return nil, nil, fmt.Errorf("bad OCSP status update for certificate at '%s': %s", certFile, err)
		} else if resp != nil && resp.Status != ocsp.Good && shutdownOnRevoke {
			return nil, nil, fmt.Errorf("found existing OCSP status for certificate at '%s': %s", certFile, ocspStatusString(resp.Status))
		}

		// Callbacks below will be in charge of returning the certificate instead,
		// so this has to be nil.
		tc.Certificates = nil

		// GetCertificate returns a certificate that's presented to a client.
		tc.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
			ccert := cert
			raw, _, err := mon.getStatus()
			if err != nil {
				return nil, err
			}
			return &tls.Certificate{
				OCSPStaple:                   raw,
				Certificate:                  ccert.Certificate,
				PrivateKey:                   ccert.PrivateKey,
				SupportedSignatureAlgorithms: ccert.SupportedSignatureAlgorithms,

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Review the reported existing status; renew or revoke handling as appropriate
2. Clear the cached OCSP entry to force a fresh fetch from the responder

When it happens

Trigger: Thrown at server/ocsp.go:459 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4bc7a10faee7a2cf. Report an issue: GitHub.