{"record":{"id":"0cfba77a99db8160","repo":"redis/redis-py","slug":"you-are-not-authorized-to-view-this-ocsp-certifica","errorCode":null,"errorMessage":"you are not authorized to view this ocsp certificate","messagePattern":"you are not authorized to view this ocsp certificate","errorType":"exception","errorClass":"AuthorizationError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":56,"sourceCode":"        elif isinstance(pubkey, EllipticCurvePublicKey):\n            pubkey.verify(\n                ocsp_response.signature,\n                ocsp_response.tbs_response_bytes,\n                ECDSA(ocsp_response.signature_hash_algorithm),\n            )\n        else:\n            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)\n    except InvalidSignature:\n        raise ConnectionError(\"failed to valid ocsp response\")\n\n\ndef _check_certificate(issuer_cert, ocsp_bytes, validate=True):\n    \"\"\"A wrapper the return the validity of a known ocsp certificate\"\"\"\n\n    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)\n\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:\n        raise AuthorizationError(\"you are not authorized to view this ocsp certificate\")\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:\n        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:\n            raise ConnectionError(\n                f\"Received an {str(ocsp_response.certificate_status).split('.')[1]} \"\n                \"ocsp certificate status\"\n            )\n    else:\n        raise ConnectionError(\n            \"failed to retrieve a successful response from the ocsp responder\"\n        )\n\n    if ocsp_response.this_update >= datetime.datetime.now():\n        raise ConnectionError(\"ocsp certificate was issued in the future\")\n\n    if (\n        ocsp_response.next_update\n        and ocsp_response.next_update < datetime.datetime.now()\n    ):","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L38-L74","documentation":"Raised as an AuthorizationError (redis.exceptions, not ConnectionError) by _check_certificate (redis/ocsp.py:56) when ocsp_response.response_status equals OCSPResponseStatus.UNAUTHORIZED. The OCSP responder refused to give a status for the requested certificate — the requester is not permitted to query status for that cert/serial. Notably OCSPVerifier.is_valid() catches AuthorizationError and retries via a direct connection, so end users normally only see this if the direct retry also fails or if the staple verifier path hit it.","triggerScenarios":"OCSP stapling path: ocsp_staple_verifier receives a stapled response whose status is UNAUTHORIZED. Direct path: check_certificate fetches a responder URL that returns UNAUTHORIZED, and either is_valid()'s direct-connection retry also returns UNAUTHORIZED, or you call check_certificate directly.","commonSituations":"The responder requires client authentication/authorization the client does not have; querying status for a certificate issued under a different CA/account; the OCSP responder is configured with an allowlist that excludes the requesting client; private/internal CA deployments where OCSP access is restricted.","solutions":["Confirm the OCSP responder URL is the correct one for the certificate's CA and that the client is authorized to query it.","If the responder requires mutual TLS or a bearer token, configure the HTTP client used for OCSP fetch accordingly.","For stapled responses, ensure the server is configured to staple an authorized response; an UNAUTHORIZED staple means the server itself was refused by the responder.","If authorization cannot be granted, disable OCSP for this endpoint only after a deliberate risk decision, or switch to CRL-based revocation checks."],"exampleFix":"# before - responder refuses the query\nverifier = OCSPVerifier(sock, host, port)\nverifier.is_valid()  # AuthorizationError on both staple and direct retry\n\n# after - confirm responder URL matches cert AIA, ensure authorization\n# (configure OCSP responder to permit the client, or use an authorized responder)","handlingStrategy":"try-catch","validationCode":"from cryptography.x509 import ocsp\n\ndef responder_authorized(ocsp_bytes):\n    resp = ocsp.load_der_ocsp_response(ocsp_bytes)\n    return resp.response_status != ocsp.OCSPResponseStatus.UNAUTHORIZED","typeGuard":null,"tryCatchPattern":"from redis.exceptions import AuthorizationError\n\ntry:\n    verifier.is_valid()\nexcept AuthorizationError as e:\n    logging.warning('OCSP responder refused the request: %s', e)\n    # configure the client to be authorized by the responder, or use an alternate responder\n    raise","preventionTips":["Confirm the OCSP responder URL is the correct one for the certificate's issuing CA.","Ensure the client is authorized to query the responder (mutual TLS / token if required).","For stapled responses, ensure the server is configured to obtain an authorized staple.","Have a fallback revocation source (CRL) for endpoints whose responder is access-restricted."],"tags":["ocsp","ssl","tls","security","authorization","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}