nats-io/nats-server · warning

no available OCSP servers

Error message

no available OCSP servers

What it means

This error (ErrNoAvailOCSPServers) is returned by FetchOCSPResponse when the certificate's chain link has no OCSP responder endpoints to query (link.OCSPWebEndpoints is empty). The library cannot perform an OCSP check without at least one AIA/web endpoint from the certificate, so it fails fast.

Solutions

1. Use certificates issued by a CA whose certs include an OCSP responder URL (AIA extension)
2. If using a private CA, deploy an OCSP responder and issue certs with its URL in AIA
3. Re-issue certificates with the OCSP endpoint included, then reload the server's certificate
4. Disable OCSP-based peer verification (CertIDP) if your PKI does not support OCSP

Example fix

// before
// cert has no OCSP URL -> FetchOCSPResponse fails
// after (openssl config)
authorityInfoAccess = OCSP;URI:http://ocsp.example.com
// re-issue certificate with AIA OCSP URI

func hasOCSPResponder(link *certidp.ChainLink) bool {
    return link != nil && link.OCSPWebEndpoints != nil && len(*link.OCSPWebEndpoints) > 0
}
if !hasOCSPResponder(link) {
    log.Warn("certificate has no OCSP responder URL; skipping OCSP check")
    return true, nil // or fail depending on policy
}

resp, err := certidp.FetchOCSPResponse(link, opts, log)
if err != nil {
    log.Warnf("no OCSP responder available for peer cert: %v", err)
    // fall back to policy: allow, deny, or warn
}

When it happens

Trigger: Calling FetchOCSPResponse on a ChainLink whose OCSPWebEndpoints list is empty/nil — i.e. the certificate carries no OCSP URL in its Authority Information Access extension.

Common situations: Using certificates issued by a CA that omits OCSP URLs, private/internal CAs without an OCSP responder, or stripped certificate extensions.

Related errors

• invalid chain link
• failed to parse ca_file
• failed to parse cert
• failed to parse OCSP response
• incomplete cert chain, got

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/608f3e096d4fc61f. Report an issue: GitHub.

Appendix: source

Thrown at server/certidp/ocsp_responder.go:64

			return nil, fmt.Errorf(ErrBadResponderHTTPStatus, resp.StatusCode)
		}
		return io.ReadAll(resp.Body)
	}

	// Request documentation:
	// https://tools.ietf.org/html/rfc6960#appendix-A.1

	reqDER, err := ocsp.CreateRequest(link.Leaf, link.Issuer, nil)
	if err != nil {
		return nil, err
	}

	reqEnc := encodeOCSPRequest(reqDER)

	responders := *link.OCSPWebEndpoints

	if len(responders) == 0 {
		return nil, errors.New(ErrNoAvailOCSPServers)
	}

	var raw []byte
	hc := &http.Client{
		Timeout: timeout,
	}
	for _, u := range responders {
		responderURL := u.String()
		log.Debugf(DbgMakingCARequest, responderURL)
		responderURL = strings.TrimSuffix(responderURL, "/")
		raw, err = getRequestBytes(fmt.Sprintf("%s/%s", responderURL, reqEnc), hc)
		if err == nil {
			break
		}
	}
	if err != nil {
		return nil, fmt.Errorf(ErrFailedWithAllRequests, err)
	}

View on GitHub (pinned to 3a66a489d2)