{"record":{"id":"58130283930e50bd","repo":"redis/redis-py","slug":"no-aia-information-present-in-ssl-certificate","errorCode":null,"errorMessage":"No AIA information present in ssl certificate","messagePattern":"No AIA information present in ssl certificate","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":216,"sourceCode":"        if der is False:\n            raise ConnectionError(\"no certificate found for ssl peer\")\n        cert = self._bin2ascii(der)\n        return self._certificate_components(cert)\n\n    def _certificate_components(self, cert):\n        \"\"\"Given an SSL certificate, retract the useful components for\n        validating the certificate status with an OCSP server.\n\n        Args:\n            cert ([bytes]): A PEM encoded ssl certificate\n        \"\"\"\n\n        try:\n            aia = cert.extensions.get_extension_for_oid(\n                x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS\n            ).value\n        except cryptography.x509.extensions.ExtensionNotFound:\n            raise ConnectionError(\"No AIA information present in ssl certificate\")\n\n        # fetch certificate issuers\n        issuers = [\n            i\n            for i in aia\n            if i.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS\n        ]\n        try:\n            issuer = issuers[0].access_location.value\n        except IndexError:\n            issuer = None\n\n        # now, the series of ocsp server entries\n        ocsps = [\n            i\n            for i in aia\n            if i.access_method == x509.oid.AuthorityInformationAccessOID.OCSP\n        ]","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L198-L234","documentation":"Raised as a ConnectionError by OCSPVerifier._certificate_components (redis/ocsp.py:216) when the peer certificate has no Authority Information Access (AIA) extension (x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS). get_extension_for_oid raises ExtensionNotFound, which is caught and re-raised as this ConnectionError. The AIA extension is where the certificate advertises its OCSP responder URL(s) and CA issuer URL; without it the verifier cannot discover where to check revocation.","triggerScenarios":"OCSPVerifier.components_from_socket / components_from_direct_connection extract AIA from the cert, but the cert was issued without an AIA extension. Internal/private CAs frequently omit AIA; self-signed certs never include it.","commonSituations":"Private/internal CA that does not embed AIA in issued certs; self-signed certificate; older CA tooling that didn't populate AIA; cert generated with openssl without the AIA extension configured.","solutions":["Re-issue the certificate with an AIA extension containing at least the OCSP responder URL (and ideally the CA Issuers URL).","If OCSP checking is not required for this deployment, disable OCSP verification for that endpoint.","Use CRL-based revocation checking instead if the CA provides CRL distribution points but not OCSP/AIA.","Confirm the cert generation profile (openssl.cnf) includes authorityInfoAccess = OCSP;URI:..."],"exampleFix":"# before - cert has no AIA extension\nverifier.is_valid()  # ConnectionError: No AIA information present in ssl certificate\n\n# after - re-issue the cert with AIA (openssl.cnf)\n# [ v3_ext ]\n# authorityInfoAccess = OCSP;URI:http://ocsp.internal-ca/ca/ocsp\n# authorityInfoAccess = caIssuers;URI:http://ocsp.internal-ca/ca.crt\n# then regenerate and redeploy the certificate","handlingStrategy":"validation","validationCode":"from cryptography import x509\nfrom cryptography.x509.oid import ExtensionOID\n\ndef cert_has_aia(cert):\n    try:\n        cert.extensions.get_extension_for_oid(ExtensionOID.AUTHORITY_INFORMATION_ACCESS)\n        return True\n    except x509.ExtensionNotFound:\n        return False","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    if 'No AIA information' in str(e):\n        logging.warning('Cert lacks AIA - re-issue with OCSP responder URL or disable OCSP')\n    raise","preventionTips":["Issue certificates with an AIA extension containing the OCSP responder URL.","For internal/private CAs, include AIA in the cert profile (openssl.cnf authorityInfoAccess).","If OCSP is not applicable, disable OCSP verification for that endpoint rather than hitting this error.","Have a CRL-based fallback for certs without AIA."],"tags":["ocsp","ssl","tls","security","aia","certificate","connection","configuration"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}