nats-io/nats-server · error

store_dir not set

Error message

store_dir not set

What it means

OCSPMonitor.getLocalStatus guard: reading the cached OCSP response from disk requires a persistent store directory, but the server's StoreDir option is empty (no JetStore/data dir configured), so local OCSP status lookup is impossible.

Source

Thrown at server/ocsp.go:129

	raw, resp, err = oc.getLocalStatus()
	if err == nil {
		return raw, resp, nil
	}

	return oc.getRemoteStatus()
}

func (oc *OCSPMonitor) getCacheStatus() ([]byte, *ocsp.Response) {
	oc.mu.Lock()
	defer oc.mu.Unlock()
	return oc.raw, oc.resp
}

func (oc *OCSPMonitor) getLocalStatus() ([]byte, *ocsp.Response, error) {
	opts := oc.srv.getOpts()
	storeDir := opts.StoreDir
	if storeDir == _EMPTY_ {
		return nil, nil, fmt.Errorf("store_dir not set")
	}

	// This key must be based upon the current full certificate, not the public key,
	// so MUST be on the full raw certificate and not an SPKI or other reduced form.
	key := fmt.Sprintf("%x", sha256.Sum256(oc.Leaf.Raw))

	oc.mu.Lock()
	raw, err := os.ReadFile(filepath.Join(storeDir, defaultOCSPStoreDir, key))
	oc.mu.Unlock()
	if err != nil {
		return nil, nil, err
	}

	resp, err := ocsp.ParseResponse(raw, oc.Issuer)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get local status: %w", err)
	}
	if err := validOCSPResponse(resp); err != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Configure a store_dir for the server so OCSP responses can be cached locally
2. Rely on remote OCSP responder status, which is what the caller falls back to

When it happens

Trigger: Thrown at server/ocsp.go:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/fa31ecda2259d4ce. Report an issue: GitHub.