{"record":{"id":"3c0ad6cf903ee6c2","repo":"redis/redis-py","slug":"no-ocsp-servers-in-certificate","errorCode":null,"errorMessage":"no ocsp servers in certificate","messagePattern":"no ocsp servers in certificate","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":239,"sourceCode":"            for i in aia\n            if i.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS\n        ]\n        try:\n            issuer = issuers[0].access_location.value\n        except IndexError:\n            issuer = None\n\n        # now, the series of ocsp server entries\n        ocsps = [\n            i\n            for i in aia\n            if i.access_method == x509.oid.AuthorityInformationAccessOID.OCSP\n        ]\n\n        try:\n            ocsp = ocsps[0].access_location.value\n        except IndexError:\n            raise ConnectionError(\"no ocsp servers in certificate\")\n\n        return cert, issuer, ocsp\n\n    def components_from_direct_connection(self):\n        \"\"\"Return the certificate, primary issuer, and primary ocsp server\n        from the host defined by the socket. This is useful in cases where\n        different certificates are occasionally presented.\n        \"\"\"\n\n        pem = ssl.get_server_certificate((self.HOST, self.PORT), ca_certs=self.CA_CERTS)\n        cert = x509.load_pem_x509_certificate(pem.encode(), backends.default_backend())\n        return self._certificate_components(cert)\n\n    def build_certificate_url(self, server, cert, issuer_cert):\n        \"\"\"Return the complete url to the ocsp\"\"\"\n        orb = ocsp.OCSPRequestBuilder()\n\n        # add_certificate returns an initialized OCSPRequestBuilder","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L221-L257","documentation":"Raised as a ConnectionError by OCSPVerifier._certificate_components (redis/ocsp.py:239) when the AIA extension exists but contains no entries with access_method == AuthorityInformationAccessOID.OCSP. The code finds CA_ISSUERS entries (used to fetch the issuer) but when filtering for OCSP entries the list is empty, so ocsps[0] raises IndexError which is converted to this ConnectionError. Without an OCSP responder URL the verifier cannot query revocation status.","triggerScenarios":"OCSPVerifier extracts AIA and it includes CA Issuers but zero OCSP access methods. The cert advertises where to get the issuer cert but not where to query OCSP — common when a CA provides only CRL-based revocation or partially configures AIA.","commonSituations":"CA includes only caIssuers in AIA (CRL-only revocation model); partial AIA configuration in the CA profile; cert predates the deployment's OCSP responder; responder decommissioned but CA Issuers retained.","solutions":["Re-issue the certificate with an OCSP access method in AIA: authorityInfoAccess = OCSP;URI:http://responder/ocsp.","If the CA only supports CRL, switch the client to CRL-based revocation checking instead of OCSPVerifier.","Disable revocation checking for this endpoint only after an explicit risk decision if no OCSP/CRL is available.","Confirm the CA profile populates both caIssuers and OCSP access methods."],"exampleFix":"# before - AIA has caIssuers but no OCSP entry\nverifier.is_valid()  # ConnectionError: no ocsp servers in certificate\n\n# after - re-issue cert with the OCSP access method in AIA\n# authorityInfoAccess = OCSP;URI:http://ocsp.example.com\n# authorityInfoAccess = caIssuers;URI:http://ca.example.com/ca.crt","handlingStrategy":"validation","validationCode":"from cryptography import x509\nfrom cryptography.x509.oid import (\n    ExtensionOID,\n    AuthorityInformationAccessOID,\n)\n\ndef cert_advertises_ocsp_url(cert):\n    try:\n        aia = cert.extensions.get_extension_for_oid(\n            ExtensionOID.AUTHORITY_INFORMATION_ACCESS\n        ).value\n    except x509.ExtensionNotFound:\n        return False\n    return any(i.access_method == AuthorityInformationAccessOID.OCSP for i in aia)","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    if 'no ocsp servers in certificate' in str(e):\n        logging.warning('AIA has no OCSP entry - re-issue cert or switch to CRL-based checking')\n    raise","preventionTips":["Include an OCSP access method in the AIA extension when issuing certs (authorityInfoAccess = OCSP;URI:...).","For CRL-only CAs, use CRL-based revocation instead of OCSPVerifier.","Populate both caIssuers and OCSP access methods in the CA profile.","Disable revocation checking for endpoints with no OCSP/CRL only after an explicit risk decision."],"tags":["ocsp","ssl","tls","security","aia","responder-url","certificate","connection","configuration"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}