{"record":{"id":"179b2e6516bd02de","repo":"redis/redis-py","slug":"no-ocsp-response-present","errorCode":null,"errorMessage":"no ocsp response present","messagePattern":"no ocsp response present","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":149,"sourceCode":"        h = pubkey.public_bytes(Encoding.DER, PublicFormat.PKCS1)\n    elif isinstance(pubkey, EllipticCurvePublicKey):\n        h = pubkey.public_bytes(Encoding.X962, PublicFormat.UncompressedPoint)\n    else:\n        h = pubkey.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)\n\n    sha1 = Hash(SHA1(), backend=backends.default_backend())\n    sha1.update(h)\n    return sha1.finalize()\n\n\ndef ocsp_staple_verifier(con, ocsp_bytes, expected=None):\n    \"\"\"An implementation of a function for set_ocsp_client_callback in PyOpenSSL.\n\n    This function validates that the provide ocsp_bytes response is valid,\n    and matches the expected, stapled responses.\n    \"\"\"\n    if ocsp_bytes in [b\"\", None]:\n        raise ConnectionError(\"no ocsp response present\")\n\n    issuer_cert = None\n    peer_cert = con.get_peer_certificate().to_cryptography()\n    for c in con.get_peer_cert_chain():\n        cert = c.to_cryptography()\n        if cert.subject == peer_cert.issuer:\n            issuer_cert = cert\n            break\n\n    if issuer_cert is None:\n        raise ConnectionError(\"no matching issuer cert found in certificate chain\")\n\n    if expected is not None:\n        e = x509.load_pem_x509_certificate(expected)\n        if peer_cert != e:\n            raise ConnectionError(\"received and expected certificates do not match\")\n\n    return _check_certificate(issuer_cert, ocsp_bytes)","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L131-L167","documentation":"Raised as a ConnectionError by ocsp_staple_verifier (redis/ocsp.py:149) when ocsp_bytes is b'' or None — i.e. the server did not provide a stapled OCSP response (RFC 6066 status_request) during the TLS handshake. The staple verifier is invoked by the ssl_ocsp_client_callback when OCSP stapling is configured, and an empty staple means the server ignored or could not satisfy the status_request.","triggerScenarios":"Configuring a Redis client with ssl_ocsp_context / set_ocsp_client_callback pointing at ocsp_staple_verifier, connecting to a server that does not support OCSP stapling or omitted the staple. The verifier is called with empty bytes and immediately rejects.","commonSituations":"Server (Redis/stunnel) not configured for OCSP stapling; TLS terminator strips the status_request extension; server's responder was unreachable so it skipped the staple; client requires stapling (must-staple cert) but the deployment never enabled it.","solutions":["Enable OCSP stapling on the server side (stunnel/Redis TLS config) so it fetches and presents a staple during the handshake.","If stapling is optional for your deployment, configure the client to tolerate a missing staple rather than hard-failing.","Confirm the server certificate supports/requests stapling (must-staple TLS feature extension) and that the responder is reachable from the server.","Verify the TLS stack surfaces the staple to the callback (some proxies terminate TLS and discard it)."],"exampleFix":"# before - client requires a staple the server doesn't send\nredis.Redis(host=h, port=p, ssl=True, ssl_ocsp_context=staple_ctx)  # ConnectionError: no ocsp response present\n\n# after - enable stapling on the server (stunnel example)\n# [redis]\n# ocsp = on\n# ocspResponderURL = http://ocsp.example.com\n# then the server staples; the client verifier receives non-empty ocsp_bytes","handlingStrategy":"validation","validationCode":"def staple_present(ocsp_bytes):\n    return ocsp_bytes not in (b'', None)\n\n# in the callback:\nif not staple_present(ocsp_bytes):\n    logging.warning('Server did not staple an OCSP response')\n    # decide policy: fail (raise) or allow based on your security posture","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    ocsp_staple_verifier(con, ocsp_bytes, expected)\nexcept RedisConnectionError as e:\n    if 'no ocsp response present' in str(e):\n        logging.warning('No OCSP staple - enable stapling on the server or relax the requirement')\n    raise","preventionTips":["Enable OCSP stapling on the server (stunnel/Redis TLS config) so it presents a staple.","If a missing staple is acceptable in your environment, configure the client to tolerate it instead of hard-failing.","Ensure the server can reach its OCSP responder to populate the staple on time.","Avoid TLS-terminating proxies that strip the status_request extension."],"tags":["ocsp","ssl","tls","security","stapling","certificate","connection","configuration"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}