nats-io/nats-server · warning

no available OCSP servers

Error message

no available OCSP servers

What it means

This error (ErrNoAvailOCSPServers) is returned by FetchOCSPResponse when the certificate's chain link has no OCSP responder endpoints to query (link.OCSPWebEndpoints is empty). The library cannot perform an OCSP check without at least one AIA/web endpoint from the certificate, so it fails fast.

Source

Thrown at server/certidp/ocsp_responder.go:64

			return nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)
		}
		return io.ReadAll(resp.Body)
	}

	// Request documentation:
	// https://tools.ietf.org/html/rfc6960#appendix-A.1

	reqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)
	if err != nil {
		return nil, err
	}

	reqEnc := encodeOCSPRequest(reqDER)

	responders := *link.OCSPWebEndpoints

	if len(responders) == 0 {
		return nil, errors.New(ErrNoAvailOCSPServers)
	}

	var raw []byte
	hc := &http.Client{
		Timeout: timeout,
	}
	for _, u := range responders {
		responderURL := u.String()
		log.Debugf(DbgMakingCARequest, responderURL)
		responderURL = strings.TrimSuffix(responderURL, "/")
		raw, err = getRequestBytes(fmt.Sprintf("%s/%s", responderURL, reqEnc), hc)
		if err == nil {
			break
		}
	}
	if err != nil {
		return nil, fmt.Errorf(ErrFailedWithAllRequests, err)
	}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use certificates issued by a CA whose certs include an OCSP responder URL (AIA extension)
2. If using a private CA, deploy an OCSP responder and issue certs with its URL in AIA
3. Re-issue certificates with the OCSP endpoint included, then reload the server's certificate
4. Disable OCSP-based peer verification (CertIDP) if your PKI does not support OCSP

Example fix

// before
// cert has no OCSP URL -> FetchOCSPResponse fails
// after (openssl config)
authorityInfoAccess = OCSP;URI:http://ocsp.example.com
// re-issue certificate with AIA OCSP URI

func hasOCSPResponder(link *certidp.ChainLink) bool {
    return link != nil && link.OCSPWebEndpoints != nil && len(*link.OCSPWebEndpoints) > 0
}
if !hasOCSPResponder(link) {
    log.Warn("certificate has no OCSP responder URL; skipping OCSP check")
    return true, nil // or fail depending on policy
}

resp, err := certidp.FetchOCSPResponse(link, opts, log)
if err != nil {
    log.Warnf("no OCSP responder available for peer cert: %v", err)
    // fall back to policy: allow, deny, or warn
}

When it happens

Trigger: Calling FetchOCSPResponse on a ChainLink whose OCSPWebEndpoints list is empty/nil — i.e. the certificate carries no OCSP URL in its Authority Information Access extension.

Common situations: Using certificates issued by a CA that omits OCSP URLs, private/internal CAs without an OCSP responder, or stripped certificate extensions.

Related errors

• invalid chain link
• unable to plug TLS verify connection, config is nil
• OCSP peer verification for client connections requires TLS v
• unable to register client OCSP verification
• missing TLS verified chains

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/608f3e096d4fc61f. Report an issue: GitHub.