nats-io/nats-server · error

OCSP staple's signer missing authorization by CA to act as O

Error message

OCSP staple's signer missing authorization by CA to act as OCSP signer

What it means

Peer-verification callback: the OCSP response was signed by a delegate certificate, but that delegate lacks the OCSPSigning extended key usage, so it is not authorized by the CA to act as an OCSP signer.

Source

Thrown at server/ocsp.go:520

				}

				// Response signature of issuer or issuer delegate is checked in the library parse
				resp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)
				if err != nil {
					return fmt.Errorf("failed to parse OCSP response from %s peer: %w", kind, err)
				}

				// If signer was issuer delegate double-check issuer delegate authorization
				if resp.Certificate != nil {
					ok := false
					for _, eku := range resp.Certificate.ExtKeyUsage {
						if eku == x509.ExtKeyUsageOCSPSigning {
							ok = true
							break
						}
					}
					if !ok {
						return fmt.Errorf("OCSP staple's signer missing authorization by CA to act as OCSP signer")
					}
				}

				// Check that the OCSP response is effective, take defaults for clockskew and default validity
				peerOpts := certidp.OCSPPeerConfig{ClockSkew: -1, TTLUnsetNextUpdate: -1}
				sLog := certidp.Log{Debugf: srv.Debugf}
				if !certidp.OCSPResponseCurrent(resp, &peerOpts, &sLog) {
					return fmt.Errorf("OCSP staple from %s peer not current", kind)
				}

				if resp.Status != ocsp.Good {
					return fmt.Errorf("bad status for OCSP Staple from %s peer: %s", kind, ocspStatusString(resp.Status))
				}

				return nil
			}

			// When server makes a peer connection, need to also present an OCSP Staple.

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Have the CA issue the responder delegate a cert with the OCSPSigning EKU
2. Use a responder signed directly by the issuer CA

When it happens

Trigger: Thrown at server/ocsp.go:520 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/f2a241d16b447f83. Report an issue: GitHub.