nats-io/nats-server · error

invalid ocsp NextUpdate, is past time: %s

Error message

invalid ocsp NextUpdate, is past time: %s

What it means

validOCSPResponse enforces RFC 6960 freshness: an OCSP response whose NextUpdate timestamp is non-zero and in the past is stale and untrusted, since the responder guarantees validity only until NextUpdate.

Source

Thrown at server/ocsp.go:989

}

func ocspStatusString(n int) string {
	switch n {
	case ocsp.Good:
		return "good"
	case ocsp.Revoked:
		return "revoked"
	default:
		return "unknown"
	}
}

func validOCSPResponse(r *ocsp.Response) error {
	// Time validation not handled by ParseResponse.
	// https://tools.ietf.org/html/rfc6960#section-4.2.2.1
	if !r.NextUpdate.IsZero() && r.NextUpdate.Before(time.Now()) {
		t := r.NextUpdate.Format(time.RFC3339Nano)
		return fmt.Errorf("invalid ocsp NextUpdate, is past time: %s", t)
	}
	if r.ThisUpdate.After(time.Now()) {
		t := r.ThisUpdate.Format(time.RFC3339Nano)
		return fmt.Errorf("invalid ocsp ThisUpdate, is future time: %s", t)
	}

	return nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Refresh the OCSP response by re-querying the responder (force cache invalidation)
2. Verify server clock with NTP: `chronyc tracking` or `timedatectl`
3. Ask the CA operator to increase responder NextUpdate window if too short

Example fix

// before: long-lived cached response reused after expiry
resp := cache.Get(cert)
// after: check and refetch
if resp.NextUpdate.Before(time.Now()) { resp = fetchFreshOCSP(cert) }

if !resp.NextUpdate.IsZero() && resp.NextUpdate.Before(time.Now()) { refetchOCSP(cert) }

resp, err := ocsp.ParseResponse(der, issuer)
if err != nil { ... }
if verr := validOCSPResponse(resp); verr != nil {
    // refetch from responder and retry once
    resp, err = fetchFresh(cert)
}

When it happens

Trigger: validOCSPResponse (called from getStatus/getLocalStatus/getRemoteStatus) receives an ocsp.Response where r.NextUpdate.Before(time.Now()) and NextUpdate is not the zero time.

Common situations: Cached OCSP responses kept past their validity window, a responder with very short NextUpdate windows, or clock skew/time drift on the NATS server host.

Related errors

• invalid ocsp ThisUpdate, is future time: %s
• invalid chain link
• no available OCSP servers
• unable to plug TLS verify connection, config is nil
• OCSP peer verification for client connections requires TLS v

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/abddf0ccf988feb0. Report an issue: GitHub.