nats-io/nats-server · error

no available ocsp servers

Error message

no available ocsp servers

What it means

getRemoteStatus guard: after applying any configured override URLs, the certificate's OCSPServer AIA list is empty, so there is no responder to query for stapling status.

Source

Thrown at server/ocsp.go:219

			return nil, fmt.Errorf("non-ok http status on POST request (reqlen=%d): %d", len(body), resp.StatusCode)
		}
		return io.ReadAll(resp.Body)
	}

	// Request documentation:
	// https://tools.ietf.org/html/rfc6960#appendix-A.1

	reqDER, err := ocsp.CreateRequest(oc.Leaf, oc.Issuer, nil)
	if err != nil {
		return nil, nil, err
	}

	responders := oc.Leaf.OCSPServer
	if len(overrideURLs) > 0 {
		responders = overrideURLs
	}
	if len(responders) == 0 {
		return nil, nil, fmt.Errorf("no available ocsp servers")
	}

	oc.mu.Lock()
	hc := oc.hc
	oc.mu.Unlock()

	var raw []byte
	for _, u := range responders {
		var postErr, getErr error
		u = strings.TrimSuffix(u, "/")
		// Prefer to make POST requests first.
		raw, postErr = postRequestBytes(u, reqDER, hc)
		if postErr == nil {
			err = nil
			break
		} else {
			// Fallback to use a GET request.
			raw, getErr = getRequestBytes(u, reqDER, hc)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Reissue the TLS certificate with an OCSP responder URL in its AIA extension
2. Configure OCSP override URLs in the server's OCSP options

When it happens

Trigger: Thrown at server/ocsp.go:219 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/34e6dd6889a4e589. Report an issue: GitHub.