nats-io/nats-server · error

unable to register server OCSP verification

Error message

unable to register server OCSP verification

What it means

Guard inside plugServerTLSOCSPPeer: the tlsConfigKind passed in is incomplete (nil config, nil tlsConfig, or nil tlsOpts), so the server-side OCSP VerifyConnection hook cannot be installed. It indicates broken internal TLS wiring while plugging OCSP verification, not a peer problem.

Source

Thrown at server/ocsp_peer.go:185

	tc := config.tlsConfig
	tcOpts := config.tlsOpts
	kind := config.kind
	if tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {
		return tc, false, nil
	}
	tc.VerifyConnection = func(cs tls.ConnectionState) error {
		if !s.tlsClientOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {
			s.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSClientRejectConnection)
			return errors.New(certidp.MsgTLSClientRejectConnection)
		}
		return nil
	}
	return tc, true, nil
}

func (s *Server) plugServerTLSOCSPPeer(config *tlsConfigKind) (*tls.Config, bool, error) {
	if config == nil || config.tlsConfig == nil || config.tlsOpts == nil {
		return nil, false, errors.New(certidp.ErrUnableToPlugTLSServer)
	}
	tc := config.tlsConfig
	tcOpts := config.tlsOpts
	kind := config.kind
	if tcOpts.OCSPPeerConfig == nil || !tcOpts.OCSPPeerConfig.Verify {
		return tc, false, nil
	}
	tc.VerifyConnection = func(cs tls.ConnectionState) error {
		if !s.tlsServerOCSPValid(cs.VerifiedChains, tcOpts.OCSPPeerConfig) {
			s.sendOCSPPeerRejectEvent(kind, peerFromVerifiedChains(cs.VerifiedChains), certidp.MsgTLSServerRejectConnection)
			return errors.New(certidp.MsgTLSServerRejectConnection)
		}
		return nil
	}
	return tc, true, nil
}

// tlsServerOCSPValid evaluates verified chains (post successful TLS handshake) against OCSP

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure the server TLS block fully specifies cert/key before enabling OCSP peer verification
2. Verify the tlsConfigKind passed to plugTLSOCSPPeer is fully populated
3. Report as a server bug if the configuration appears complete

When it happens

Trigger: Thrown at server/ocsp_peer.go:185 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/11beb76a08f37d12. Report an issue: GitHub.