nats-io/nats-server · error

OCSP staple from %s peer not current

Error message

OCSP staple from %s peer not current

What it means

Peer-verification callback: certidp.OCSPResponseCurrent reported the staple as not currently valid (outside its thisUpdate/nextUpdate window, with default clock-skew and unset-next-update policy). The peer is offering a stale OCSP staple.

Source

Thrown at server/ocsp.go:528

				// If signer was issuer delegate double-check issuer delegate authorization
				if resp.Certificate != nil {
					ok := false
					for _, eku := range resp.Certificate.ExtKeyUsage {
						if eku == x509.ExtKeyUsageOCSPSigning {
							ok = true
							break
						}
					}
					if !ok {
						return fmt.Errorf("OCSP staple's signer missing authorization by CA to act as OCSP signer")
					}
				}

				// Check that the OCSP response is effective, take defaults for clockskew and default validity
				peerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}
				sLog := certidp.Log{Debugf: srv.Debugf}
				if !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {
					return fmt.Errorf("OCSP staple from %s peer not current", kind)
				}

				if resp.Status != ocsp.Good {
					return fmt.Errorf("bad status for OCSP Staple from %s peer: %s", kind, ocspStatusString(resp.Status))
				}

				return nil
			}

			// When server makes a peer connection, need to also present an OCSP Staple.
			tc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
				ccert := cert
				raw, _, err := mon.getStatus()
				if err != nil {
					return nil, err
				}
				// NOTE: crypto/tls.sendClientCertificate internally also calls getClientCertificate
				// so if for some reason these callbacks are triggered concurrently during a reconnect

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Have the peer refresh its staple from the OCSP responder
2. Verify the peer's and this server's clocks are sane

When it happens

Trigger: Thrown at server/ocsp.go:528 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b440e8cbe3a14e3f. Report an issue: GitHub.