{"record":{"id":"72183205c5581fcb","repo":"redis/redis-py","slug":"python-wasn-t-built-with-ssl-support-721832","errorCode":null,"errorMessage":"Python wasn't built with SSL support","messagePattern":"Python wasn't built with SSL support","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"critical","filePath":"redis/connection.py","lineNumber":2134,"sourceCode":"            ssl_exclude_verify_flags: A list of flags to be excluded from the SSLContext.verify_flags. Defaults to None.\n            ssl_ca_certs: The path to a file of concatenated CA certificates in PEM format. Defaults to None.\n            ssl_ca_data: Either an ASCII string of one or more PEM-encoded certificates or a bytes-like object of DER-encoded certificates.\n            ssl_check_hostname: If set, match the hostname during the SSL handshake. Defaults to True.\n            ssl_ca_path: The path to a directory containing several CA certificates in PEM format. Defaults to None.\n            ssl_password: Password for unlocking an encrypted private key. Defaults to None.\n\n            ssl_validate_ocsp: If set, perform a full ocsp validation (i.e not a stapled verification)\n            ssl_validate_ocsp_stapled: If set, perform a validation on a stapled ocsp response\n            ssl_ocsp_context: A fully initialized OpenSSL.SSL.Context object to be used in verifying the ssl_ocsp_expected_cert\n            ssl_ocsp_expected_cert: A PEM armoured string containing the expected certificate to be returned from the ocsp verification service.\n            ssl_min_version: The lowest supported SSL version. It affects the supported SSL versions of the SSLContext. None leaves the default provided by ssl module.\n            ssl_ciphers: A string listing the ciphers that are allowed to be used. Defaults to None, which means that the default ciphers are used. See https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers for more information.\n\n        Raises:\n            RedisError\n        \"\"\"  # noqa\n        if not SSL_AVAILABLE:\n            raise RedisError(\"Python wasn't built with SSL support\")\n\n        self.keyfile = ssl_keyfile\n        self.certfile = ssl_certfile\n        if ssl_cert_reqs is None:\n            ssl_cert_reqs = ssl.CERT_NONE\n        elif isinstance(ssl_cert_reqs, str):\n            CERT_REQS = {  # noqa: N806\n                \"none\": ssl.CERT_NONE,\n                \"optional\": ssl.CERT_OPTIONAL,\n                \"required\": ssl.CERT_REQUIRED,\n            }\n            if ssl_cert_reqs not in CERT_REQS:\n                raise RedisError(\n                    f\"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}\"\n                )\n            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]\n        self.cert_reqs = ssl_cert_reqs\n        self.ssl_include_verify_flags = ssl_include_verify_flags","sourceCodeStart":2116,"sourceCodeEnd":2152,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2116-L2152","documentation":"Raised in SSLConnection.__init__ when the module-level flag SSL_AVAILABLE is False, meaning Python's interpreter was compiled without the stdlib ssl module (import ssl failed). redis-py cannot construct a TLS connection without it because it relies on ssl.create_default_context and ssl.wrap_socket. This is a hard environment failure, not a runtime network problem.","triggerScenarios":"Constructing SSLConnection directly, calling redis.from_url('rediss://...'), or passing ssl=True / connection_class=SSLConnection on a Python build where the ssl C extension is absent.","commonSituations":"Custom-compiled CPython without OpenSSL headers linked (common in stripped Docker images or source builds without libssl-dev). Alpine Linux images missing libssl. Embedded Python distributions that exclude the ssl module. A rediss:// URL accidentally used against such an interpreter.","solutions":["Reinstall or rebuild Python against OpenSSL so the ssl module imports (python -c 'import ssl' should succeed).","Switch to an official Python Docker image (python:3.x-slim includes ssl) instead of a from-scratch build.","On Alpine, install openssl/libssl and rebuild Python, or use a glibc-based image.","If TLS is not actually required, drop the rediss:// scheme / ssl=True and use a plain redis:// connection."],"exampleFix":"# before - fails on a Python built without ssl\nr = redis.Redis.from_url('rediss://host:6379')\n# after - ensure ssl imports first, else fall back\nimport ssl as _ssl_test  # raises ImportError if absent\nr = redis.Redis.from_url('rediss://host:6379')","handlingStrategy":"validation","validationCode":"try:\n    import ssl  # noqa: F401\n    ssl_ok = True\nexcept ImportError:\n    ssl_ok = False\n\nif not ssl_ok:\n    raise RuntimeError('Python ssl module unavailable; cannot use rediss:// or SSLConnection')\n\nr = redis.Redis.from_url('rediss://host:6379')","typeGuard":"import ssl\n\ndef ssl_available() -> bool:\n    try:\n        import ssl as _ssl  # noqa: F401\n        return True\n    except ImportError:\n        return False","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    r = redis.Redis.from_url('rediss://host')\nexcept RedisError as e:\n    if 'SSL support' in str(e):\n        raise SystemExit('Rebuild Python with OpenSSL, or use redis:// without TLS')\n    raise","preventionTips":["Run python -c 'import ssl' in your base image during CI to catch missing ssl support early.","Prefer official python:* Docker images which bundle ssl.","Don't enable rediss:// unless you have verified the interpreter supports ssl."],"tags":["ssl","environment","configuration","dependency"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}