nats-io/nats-server · error

invalid ocsp ThisUpdate, is future time: %s

Error message

invalid ocsp ThisUpdate, is future time: %s

What it means

validOCSPResponse also rejects responses whose ThisUpdate timestamp is in the future — the responder claims the status was produced at a later time, indicating clock skew or a malicious/broken responder per RFC 6960.

Source

Thrown at server/ocsp.go:993

	case ocsp.Good:
		return "good"
	case ocsp.Revoked:
		return "revoked"
	default:
		return "unknown"
	}
}

func validOCSPResponse(r *ocsp.Response) error {
	// Time validation not handled by ParseResponse.
	// https://tools.ietf.org/html/rfc6960#section-4.2.2.1
	if !r.NextUpdate.IsZero() && r.NextUpdate.Before(time.Now()) {
		t := r.NextUpdate.Format(time.RFC3339Nano)
		return fmt.Errorf("invalid ocsp NextUpdate, is past time: %s", t)
	}
	if r.ThisUpdate.After(time.Now()) {
		t := r.ThisUpdate.Format(time.RFC3339Nano)
		return fmt.Errorf("invalid ocsp ThisUpdate, is future time: %s", t)
	}

	return nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Sync the NATS server clock via NTP (`timedatectl set-ntp true`)
2. Compare clocks with the responder host; escalate to the CA operator if the responder is at fault
3. Reject/refresh the response and re-query the responder

Example fix

// before: server clock 2h behind, responses appear future-dated
# fix clock sync
// after
timedatectl set-ntp true && chronyc makestep

if resp.ThisUpdate.After(time.Now()) { refetchOCSP(cert) }

if verr := validOCSPResponse(resp); verr != nil {
    if strings.Contains(verr.Error(), "ThisUpdate, is future") {
        // suspect clock skew: refetch after syncing time
        resp, err = fetchFresh(cert)
    }
}

When it happens

Trigger: validOCSPResponse receives a response where r.ThisUpdate.After(time.Now()) is true.

Common situations: NATS host clock behind the OCSP responder's clock, misconfigured responder issuing responses with future ThisUpdate, or time zone handling bugs when responders stamp times.

Related errors

• invalid ocsp NextUpdate, is past time: %s
• invalid chain link
• no available OCSP servers
• unable to plug TLS verify connection, config is nil
• OCSP peer verification for client connections requires TLS v

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/8bb9e49a07168eaf. Report an issue: GitHub.