{"record":{"id":"154f3bad6b604c01","repo":"redis/redis-py","slug":"failed-to-fetch-issuer-certificate","errorCode":null,"errorMessage":"failed to fetch issuer certificate","messagePattern":"failed to fetch issuer certificate","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":274,"sourceCode":"\n        # add_certificate returns an initialized OCSPRequestBuilder\n        orb = orb.add_certificate(\n            cert, issuer_cert, cryptography.hazmat.primitives.hashes.SHA256()\n        )\n        request = orb.build()\n\n        path = base64.b64encode(\n            request.public_bytes(hazmat.primitives.serialization.Encoding.DER)\n        )\n        url = urljoin(server, path.decode(\"ascii\"))\n        return url\n\n    def check_certificate(self, server, cert, issuer_url):\n        \"\"\"Checks the validity of an ocsp server for an issuer\"\"\"\n\n        r = requests.get(issuer_url)\n        if not r.ok:\n            raise ConnectionError(\"failed to fetch issuer certificate\")\n        der = r.content\n        issuer_cert = self._bin2ascii(der)\n\n        ocsp_url = self.build_certificate_url(server, cert, issuer_cert)\n\n        # HTTP 1.1 mandates the addition of the Host header in ocsp responses\n        header = {\n            \"Host\": urlparse(ocsp_url).netloc,\n            \"Content-Type\": \"application/ocsp-request\",\n        }\n        r = requests.get(ocsp_url, headers=header)\n        if not r.ok:\n            raise ConnectionError(\"failed to fetch ocsp certificate\")\n        return _check_certificate(issuer_cert, r.content, True)\n\n    def is_valid(self):\n        \"\"\"Returns the validity of the certificate wrapping our socket.\n        This first retrieves for validate the certificate, issuer_url,","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L256-L292","documentation":"Raised as a ConnectionError by OCSPVerifier.check_certificate (redis/ocsp.py:274) when requests.get(issuer_url).ok is False — the HTTP fetch of the issuer certificate (from the AIA CA Issuers URL) failed with a non-2xx status. The verifier needs the issuer cert to build the OCSP request and verify the response signature, so an issuer fetch failure aborts before OCSP can be queried.","triggerScenarios":"OCSPVerifier.is_valid()/check_certificate() fetches the CA Issuers URL extracted from AIA, and the HTTP server returns an error (404, 500, etc.) or is unreachable. requests.get is called without a timeout, so a hung server can also stall here before raising.","commonSituations":"CA Issuers URL is wrong or returns 404; the CA's issuer-cert hosting endpoint is down; network/firewall blocks the HTTP fetch; corporate proxy required but not configured for requests; URL uses a cert the client rejects; the issuer cert was relocated and AIA points to the old location.","solutions":["Verify the CA Issuers URL in the certificate's AIA resolves and serves the issuer cert (curl the URL).","Ensure the host running redis-py can reach the CA Issuers endpoint (firewall/proxy/DNS); configure requests to use the proxy if needed.","If the URL is stale, re-issue the cert with the corrected CA Issuers AIA entry.","As a workaround, supply the issuer cert out-of-band if your verification path allows it, but prefer fixing the published URL."],"exampleFix":"# before - CA Issuers URL unreachable / 404\nverifier.is_valid()  # ConnectionError: failed to fetch issuer certificate\n\n# after - confirm/fetch the issuer cert URL and fix AIA if stale\n# curl -sSI <issuer_url>  -> 200 OK with application/x-x509-ca-cert\n# if stale, re-issue cert with correct caIssuers URI in AIA","handlingStrategy":"try-catch","validationCode":"import requests\n\ndef issuer_url_reachable(issuer_url, timeout=5):\n    try:\n        r = requests.get(issuer_url, timeout=timeout)\n        return r.ok\n    except requests.RequestException:\n        return False","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    if 'failed to fetch issuer certificate' in str(e):\n        logging.warning('CA Issuers URL unreachable - check network/proxy and AIA URL: %s', e)\n    raise","preventionTips":["Verify the CA Issuers URL in AIA serves the issuer cert (curl the URL for a 200 + DER cert).","Ensure egress firewall/proxy/DNS allows the host to reach the CA Issuers endpoint; configure requests proxy if needed.","Re-issue the cert with a corrected caIssuers AIA entry if the URL is stale.","Provide the issuer cert out-of-band if the URL cannot be fixed, where the verification path supports it."],"tags":["ocsp","ssl","tls","security","network","issuer-certificate","http","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}