{"record":{"id":"04f9c3884fc56d5a","repo":"redis/redis-py","slug":"failed-to-retrieve-a-successful-response-from-the","errorCode":null,"errorMessage":"failed to retrieve a successful response from the ocsp responder","messagePattern":"failed to retrieve a successful response from the ocsp responder","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":64,"sourceCode":"    except InvalidSignature:\n        raise ConnectionError(\"failed to valid ocsp response\")\n\n\ndef _check_certificate(issuer_cert, ocsp_bytes, validate=True):\n    \"\"\"A wrapper the return the validity of a known ocsp certificate\"\"\"\n\n    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)\n\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:\n        raise AuthorizationError(\"you are not authorized to view this ocsp certificate\")\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:\n        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:\n            raise ConnectionError(\n                f\"Received an {str(ocsp_response.certificate_status).split('.')[1]} \"\n                \"ocsp certificate status\"\n            )\n    else:\n        raise ConnectionError(\n            \"failed to retrieve a successful response from the ocsp responder\"\n        )\n\n    if ocsp_response.this_update >= datetime.datetime.now():\n        raise ConnectionError(\"ocsp certificate was issued in the future\")\n\n    if (\n        ocsp_response.next_update\n        and ocsp_response.next_update < datetime.datetime.now()\n    ):\n        raise ConnectionError(\"ocsp certificate has invalid update - in the past\")\n\n    responder_name = ocsp_response.responder_name\n    issuer_hash = ocsp_response.issuer_key_hash\n    responder_hash = ocsp_response.responder_key_hash\n\n    cert_to_validate = issuer_cert\n    if (","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L46-L82","documentation":"Raised as a ConnectionError by _check_certificate (redis/ocsp.py:64) in the else branch — the response_status is neither UNAUTHORIZED nor SUCCESSFUL. Per RFC 6960 these are statuses like MALFORMED_REQUEST, INTERNAL_ERROR, TRY_LATER, SIG_REQUIRED, or UNAUTHORIZED. The responder processed the request but could not return a valid status, so the certificate's revocation state is undetermined and the connection is blocked.","triggerScenarios":"The OCSP responder returns a non-success top-level response_status (any value other than SUCCESSFUL or UNAUTHORIZED). Common during responder maintenance (TRY_LATER), malformed requests (MALFORMED_REQUEST), responder bugs (INTERNAL_ERROR), or when the responder requires a signed request (SIG_REQUIRED).","commonSituations":"Responder temporarily returning TRY_LATER during a maintenance window; malformed OCSP request due to a corrupted/unsupported cert encoding; responder INTERNAL_ERROR from a backend outage; SIG_REQUIRED when the responder policy mandates signed OCSP requests; network appliance mangling the request body.","solutions":["Retry the OCSP check — TRY_LATER is explicitly a transient status and a retry often succeeds once the responder recovers.","If SIG_REQUIRED, configure the OCSP request to be signed per the responder's policy (the current redis-py OCSP path does not sign requests, so this indicates a responder policy mismatch).","Inspect the raw response_status via ocsp.load_der_ocsp_response to identify the specific non-success code and act accordingly.","Confirm the OCSP request payload is well-formed for the responder (correct hash algorithm, supported issuer) to avoid MALFORMED_REQUEST."],"exampleFix":"# before - single OCSP attempt fails on TRY_LATER / INTERNAL_ERROR\nverifier.is_valid()  # ConnectionError: failed to retrieve a successful response\n\n# after - retry transient responder failures with backoff\nfor attempt in range(3):\n    try:\n        return verifier.is_valid()\n    except ConnectionError:\n        time.sleep(2 ** attempt)\nraise","handlingStrategy":"retry","validationCode":"from cryptography.x509 import ocsp\n\ndef responder_status_is_usable(ocsp_bytes):\n    resp = ocsp.load_der_ocsp_response(ocsp_bytes)\n    return resp.response_status in (\n        ocsp.OCSPResponseStatus.SUCCESSFUL,\n        ocsp.OCSPResponseStatus.UNAUTHORIZED,\n    )","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\nfor attempt in range(3):\n    try:\n        return verifier.is_valid()\n    except RedisConnectionError as e:\n        if 'failed to retrieve a successful response' in str(e):\n            time.sleep(2 ** attempt)  # TRY_LATER is transient\n            continue\n        raise\nraise","preventionTips":["Retry OCSP checks with backoff to ride through TRY_LATER and transient INTERNAL_ERROR.","Inspect the raw response_status to distinguish retryable (TRY_LATER) from policy (SIG_REQUIRED) conditions.","If the responder requires signed requests, switch to a verification path that signs them.","Monitor responder availability so maintenance windows don't surface as user-facing failures."],"tags":["ocsp","ssl","tls","security","responder","transient","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}