{"record":{"id":"40f60b81cdc31133","repo":"redis/redis-py","slug":"no-certificates-found-for-the-responder","errorCode":null,"errorMessage":"no certificates found for the responder","messagePattern":"no certificates found for the responder","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":97,"sourceCode":"    responder_hash = ocsp_response.responder_key_hash\n\n    cert_to_validate = issuer_cert\n    if (\n        responder_name is not None\n        and responder_name == issuer_cert.subject\n        or responder_hash == issuer_hash\n    ):\n        cert_to_validate = issuer_cert\n    else:\n        certs = ocsp_response.certificates\n        responder_certs = _get_certificates(\n            certs, issuer_cert, responder_name, responder_hash\n        )\n\n        try:\n            responder_cert = responder_certs[0]\n        except IndexError:\n            raise ConnectionError(\"no certificates found for the responder\")\n\n        ext = responder_cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)\n        if ext is None or x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING not in ext.value:\n            raise ConnectionError(\"delegate not authorized for ocsp signing\")\n        cert_to_validate = responder_cert\n\n    if validate:\n        _verify_response(cert_to_validate, ocsp_response)\n    return True\n\n\ndef _get_certificates(certs, issuer_cert, responder_name, responder_hash):\n    if responder_name is None:\n        certificates = [\n            c\n            for c in certs\n            if _get_pubkey_hash(c) == responder_hash and c.issuer == issuer_cert.subject\n        ]","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L79-L115","documentation":"Raised as a ConnectionError by _check_certificate (redis/ocsp.py:97) when the OCSP response uses a delegated responder (responder does not match the issuer) and no certificate in ocsp_response.certificates matches the responder identity (by name or key hash) and chains to the issuer. Without the responder's cert, its signature cannot be verified, so the response is rejected.","triggerScenarios":"OCSP verification with a delegated responder where the embedded certs list is empty or contains no cert whose subject==responder_name / public key hash==responder_key_hash and whose issuer==issuer_cert.subject. The IndexError on responder_certs[0] is caught and converted to this ConnectionError.","commonSituations":"Responder omitted its signing cert from the response (non-standard/misconfigured responder); responder used a key hash/name the client computes differently (encoding mismatch in _get_pubkey_hash for non-RSA/non-EC keys); chain mismatch where the embedded cert's issuer doesn't match the selected issuer cert; outdated responder cert after a delegation rotation.","solutions":["Confirm the responder includes its delegated signing certificate in the OCSP response (RFC 6960 recommends it).","Verify the issuer cert used for matching is the correct one for the peer certificate.","Check that the public-key hashing in _get_pubkey_hash matches the responder's key type (RSA/EC handled explicitly; other key types use SubjectPublicKeyInfo).","If the responder legitimately omits the cert, obtain it out-of-band or use an authorized direct responder that signs with the CA's own key."],"exampleFix":"# before - delegated responder did not embed its signing cert\n_check_certificate(issuer_cert, ocsp_bytes)  # ConnectionError: no certificates found for the responder\n\n# after - use a responder that includes the delegated cert, or one that signs with the issuer key\n# (configure OCSP responder to embed responder cert per RFC 6960 sec 4.2.2.2)","handlingStrategy":"try-catch","validationCode":"from cryptography.x509 import ocsp\n\ndef response_embeds_responder_cert(ocsp_bytes, issuer_cert, responder_name, responder_hash):\n    resp = ocsp.load_der_ocsp_response(ocsp_bytes)\n    # mirror the matching logic in _get_certificates\n    return len(resp.certificates) > 0","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    _check_certificate(issuer_cert, ocsp_bytes)\nexcept RedisConnectionError as e:\n    if 'no certificates found for the responder' in str(e):\n        logging.warning('Delegated responder did not embed its signing cert')\n    raise","preventionTips":["Use an OCSP responder that embeds its delegated signing certificate in the response per RFC 6960.","Confirm the issuer cert used for matching is correct so responder cert selection succeeds.","Prefer an authorized responder (signs with the CA key) to avoid delegated-cert dependencies entirely.","Validate the responder cert matches by both name and key hash to avoid selection mismatches."],"tags":["ocsp","ssl","tls","security","responder","delegation","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}