{"record":{"id":"3e6b04b450a61eb5","repo":"redis/redis-py","slug":"delegate-not-authorized-for-ocsp-signing","errorCode":null,"errorMessage":"delegate not authorized for ocsp signing","messagePattern":"delegate not authorized for ocsp signing","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":101,"sourceCode":"        responder_name is not None\n        and responder_name == issuer_cert.subject\n        or responder_hash == issuer_hash\n    ):\n        cert_to_validate = issuer_cert\n    else:\n        certs = ocsp_response.certificates\n        responder_certs = _get_certificates(\n            certs, issuer_cert, responder_name, responder_hash\n        )\n\n        try:\n            responder_cert = responder_certs[0]\n        except IndexError:\n            raise ConnectionError(\"no certificates found for the responder\")\n\n        ext = responder_cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)\n        if ext is None or x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING not in ext.value:\n            raise ConnectionError(\"delegate not authorized for ocsp signing\")\n        cert_to_validate = responder_cert\n\n    if validate:\n        _verify_response(cert_to_validate, ocsp_response)\n    return True\n\n\ndef _get_certificates(certs, issuer_cert, responder_name, responder_hash):\n    if responder_name is None:\n        certificates = [\n            c\n            for c in certs\n            if _get_pubkey_hash(c) == responder_hash and c.issuer == issuer_cert.subject\n        ]\n    else:\n        certificates = [\n            c\n            for c in certs","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L83-L119","documentation":"Raised as a ConnectionError by _check_certificate (redis/ocsp.py:101) when a delegated responder certificate was found but it lacks the ExtendedKeyUsage extension containing the OCSP_SIGNING OID (x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING). RFC 6960 requires a delegated OCSP responder to hold this EKU to sign responses on behalf of the CA; its absence means the responder is not authorized to assert revocation status.","triggerScenarios":"OCSP verification with a delegated responder whose certificate does not include ExtendedKeyUsage with OCSP_SIGNING. The code loads responder_certs[0], calls get_extension_for_class(x509.ExtendedKeyUsage), and if absent or missing the OCSP_SIGNING OID, raises.","commonSituations":"Responder cert issued by the CA but without the OCSP signing EKU (misissued); a cert was repurposed for OCSP signing without the proper EKU; CA tooling misconfiguration during responder cert renewal; the 'responder cert' selected is actually an unrelated cert that matched the name/hash by coincidence.","solutions":["Have the CA re-issue the delegated responder certificate with the OCSP_SIGNING ExtendedKeyUsage OID.","Confirm the correct responder cert is being selected (see error 470) so a non-OCSP cert isn't mistakenly tested for the EKU.","If the responder should sign directly with the CA key (authorized responder), configure it so responder identity matches the issuer and the delegation path is not taken.","Validate responder cert issuance against your PKI policy for OCSP delegation."],"exampleFix":"# before - responder cert lacks OCSP_SIGNING EKU\n_check_certificate(...)  # ConnectionError: delegate not authorized for ocsp signing\n\n# after - re-issue responder cert with the OCSP signing EKU\n# openssl: add extendedKeyUsage = OCSPSigning to the responder cert profile, re-issue, redeploy","handlingStrategy":"try-catch","validationCode":"from cryptography import x509\nfrom cryptography.x509.oid import ExtendedKeyUsageOID\n\ndef cert_authorized_for_ocsp_signing(cert):\n    try:\n        ext = cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)\n        return ext is not None and ExtendedKeyUsageOID.OCSP_SIGNING in ext.value\n    except x509.ExtensionNotFound:\n        return False","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    _check_certificate(issuer_cert, ocsp_bytes)\nexcept RedisConnectionError as e:\n    if 'delegate not authorized for ocsp signing' in str(e):\n        logging.warning('Responder cert missing OCSP_SIGNING EKU - re-issue with the EKU')\n    raise","preventionTips":["Issue delegated OCSP responder certificates with the OCSP_SIGNING ExtendedKeyUsage OID.","Use an authorized (CA-key-signed) responder to bypass the delegation path entirely.","Verify responder cert selection so a coincidentally-matching cert isn't tested for the EKU.","Automate responder cert renewal with the correct EKU profile."],"tags":["ocsp","ssl","tls","security","responder","delegation","eku","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}