nats-io/nats-server · error

non-ok http status on GET request (reqlen=%d): %d

Error message

non-ok http status on GET request (reqlen=%d): %d

What it means

getRemoteStatus's GET helper: an OCSP responder returned an HTTP status above 299 for the base64-encoded GET request. The request length and status code are included; the loop over responders treats this as a failure of that server.

Source

Thrown at server/ocsp.go:179

	opts := oc.srv.getOpts()
	var overrideURLs []string
	if config := opts.OCSPConfig; config != nil {
		overrideURLs = config.OverrideURLs
	}
	getRequestBytes := func(u string, reqDER []byte, hc *http.Client) ([]byte, error) {
		reqEnc := base64.StdEncoding.EncodeToString(reqDER)
		u = fmt.Sprintf("%s/%s", u, reqEnc)
		start := time.Now()
		resp, err := hc.Get(u)
		if err != nil {
			return nil, err
		}
		defer resp.Body.Close()

		oc.srv.Debugf("Received OCSP response (method=GET, status=%v, url=%s, duration=%.3fs)",
			resp.StatusCode, u, time.Since(start).Seconds())
		if resp.StatusCode > 299 {
			return nil, fmt.Errorf("non-ok http status on GET request (reqlen=%d): %d", len(reqEnc), resp.StatusCode)
		}
		return io.ReadAll(resp.Body)
	}
	postRequestBytes := func(u string, body []byte, hc *http.Client) ([]byte, error) {
		hreq, err := http.NewRequest("POST", u, bytes.NewReader(body))
		if err != nil {
			return nil, err
		}
		hreq.Header.Add("Content-Type", "application/ocsp-request")
		hreq.Header.Add("Accept", "application/ocsp-response")

		start := time.Now()
		resp, err := hc.Do(hreq)
		if err != nil {
			return nil, err
		}
		defer resp.Body.Close()

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the OCSP responder URL's health and the certificate's AIA field
2. Allow the monitor to try the next responder or the POST method (built-in fallback)
3. Investigate responder-side rate limiting or auth requirements

When it happens

Trigger: Thrown at server/ocsp.go:179 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/465deb8412601f40. Report an issue: GitHub.