nats-io/nats-server · error

%s peer missing OCSP Staple

Error message

%s peer missing OCSP Staple

What it means

TLS VerifyConnection callback for cluster/router and gateway peer connections: the peer did not present an OCSP staple (s.OCSPResponse nil) even though the server is configured to require and verify staples from peers of this kind.

Source

Thrown at server/ocsp.go:489

				return nil, err
			}
			return &tls.Certificate{
				OCSPStaple:                   raw,
				Certificate:                  ccert.Certificate,
				PrivateKey:                   ccert.PrivateKey,
				SupportedSignatureAlgorithms: ccert.SupportedSignatureAlgorithms,
				SignedCertificateTimestamps:  ccert.SignedCertificateTimestamps,
				Leaf:                         ccert.Leaf,
			}, nil
		}

		// Check whether need to verify staples from a peer router or gateway connection.
		switch kind {
		case kindStringMap[ROUTER], kindStringMap[GATEWAY]:
			tc.VerifyConnection = func(s tls.ConnectionState) error {
				oresp := s.OCSPResponse
				if oresp == nil {
					return fmt.Errorf("%s peer missing OCSP Staple", kind)
				}

				// Peer connections will verify the response of the staple.
				if len(s.VerifiedChains) == 0 {
					return fmt.Errorf("%s peer missing TLS verified chains", kind)
				}

				chain := s.VerifiedChains[0]
				peerLeaf := chain[0]
				peerIssuer := certidp.GetLeafIssuerCert(chain, 0)
				if peerIssuer == nil {
					return fmt.Errorf("failed to get issuer certificate for %s peer", kind)
				}

				// Response signature of issuer or issuer delegate is checked in the library parse
				resp, err := ocsp.ParseResponseForCert(oresp, peerLeaf, peerIssuer)
				if err != nil {
					return fmt.Errorf("failed to parse OCSP response from %s peer: %w", kind, err)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Enable OCSP stapling on the peer server's TLS config
2. Remove the requirement to verify peer staples if not needed

When it happens

Trigger: Thrown at server/ocsp.go:489 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7768dd20b825587e. Report an issue: GitHub.