nats-io/nats-server · error

invalid issuer configuration: %w

Error message

invalid issuer configuration: %w

What it means

When a second certificate is present in the bundle, it is assumed to be the leaf's issuer and is verified via CheckSignature. If the second cert's signature does not verify the leaf's TBS certificate, the bundle issuer is misconfigured and the underlying x509 error is wrapped and returned.

Source

Thrown at server/ocsp.go:915

func getOCSPIssuerLocally(trustedCAs []*x509.Certificate, certBundle []*x509.Certificate) (*x509.Certificate, error) {
	var vOpts x509.VerifyOptions
	var leaf *x509.Certificate
	trustedCAPool := x509.NewCertPool()

	// Require Leaf as first cert in bundle
	if len(certBundle) > 0 {
		leaf = certBundle[0]
	} else {
		return nil, fmt.Errorf("invalid ocsp ca configuration")
	}

	// Allow Issuer to be configured as second cert in bundle
	if len(certBundle) > 1 {
		// The operator may have misconfigured the cert bundle
		issuerCandidate := certBundle[1]
		err := issuerCandidate.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature)
		if err != nil {
			return nil, fmt.Errorf("invalid issuer configuration: %w", err)
		} else {
			return issuerCandidate, nil
		}
	}

	// Operator did not provide the Leaf Issuer in cert bundle second position
	// so we will attempt to create at least one ordered verified chain from the
	// trusted CA pool.

	// Specify CA trust store to validator; if unset, system trust store used
	if len(trustedCAs) > 0 {
		for _, ca := range trustedCAs {
			trustedCAPool.AddCert(ca)
		}
		vOpts.Roots = trustedCAPool
	}

	return certstore.GetLeafIssuer(leaf, vOpts), nil

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Confirm the second certificate in the bundle actually signed the leaf (openssl verify -CAfile issuer.pem leaf.pem)
2. Rebuild the bundle in the correct order: leaf first, then its direct issuer
3. Regenerate/re-download the fullchain from the CA after certificate renewal

Example fix

// before
cat server.crt other-ca.pem > bundle.pem
// after
cat server.crt real-intermediate.pem > bundle.pem
# openssl verify -CAfile real-intermediate.pem server.crt

leaf, issuer := bundle[0], bundle[1]
if err := issuer.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature); err != nil {
    return fmt.Errorf("bundle position 2 is not the leaf's issuer: %w", err)
}

When it happens

Trigger: certBundle[1] fails CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature) — the second cert is not the CA that signed the leaf.

Common situations: Operators concatenate certificates from unrelated chains, place an intermediate in the wrong order, or pass a fullchain where the second cert belongs to a different leaf (e.g. copied wrong fullchain after cert renewal).

Related errors

• incomplete cert chain, got %d, want at least %d
• failed to parse cert: %v
• no issuers found
• invalid chain link
• no available OCSP servers

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/01be40d10511d82c. Report an issue: GitHub.