{"record":{"id":"738637536252327b","repo":"redis/redis-py","slug":"ocsp-certificate-was-issued-in-the-future","errorCode":null,"errorMessage":"ocsp certificate was issued in the future","messagePattern":"ocsp certificate was issued in the future","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"warning","filePath":"redis/ocsp.py","lineNumber":69,"sourceCode":"    \"\"\"A wrapper the return the validity of a known ocsp certificate\"\"\"\n\n    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)\n\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:\n        raise AuthorizationError(\"you are not authorized to view this ocsp certificate\")\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:\n        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:\n            raise ConnectionError(\n                f\"Received an {str(ocsp_response.certificate_status).split('.')[1]} \"\n                \"ocsp certificate status\"\n            )\n    else:\n        raise ConnectionError(\n            \"failed to retrieve a successful response from the ocsp responder\"\n        )\n\n    if ocsp_response.this_update >= datetime.datetime.now():\n        raise ConnectionError(\"ocsp certificate was issued in the future\")\n\n    if (\n        ocsp_response.next_update\n        and ocsp_response.next_update < datetime.datetime.now()\n    ):\n        raise ConnectionError(\"ocsp certificate has invalid update - in the past\")\n\n    responder_name = ocsp_response.responder_name\n    issuer_hash = ocsp_response.issuer_key_hash\n    responder_hash = ocsp_response.responder_key_hash\n\n    cert_to_validate = issuer_cert\n    if (\n        responder_name is not None\n        and responder_name == issuer_cert.subject\n        or responder_hash == issuer_hash\n    ):\n        cert_to_validate = issuer_cert","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L51-L87","documentation":"Raised as a ConnectionError by _check_certificate (redis/ocsp.py:69) when ocsp_response.this_update >= datetime.datetime.now(). The thisUpdate field is when the responder asserts the status; a value in the future is invalid per RFC 6960 and indicates either clock skew between client and responder or a tampered/misconfigured response.","triggerScenarios":"OCSP verification runs and the response's thisUpdate timestamp is at or after the client's current wall clock. Triggered by NTP drift on the client, a responder with a wrong clock, or a forged response with a future-dated thisUpdate.","commonSituations":"Client clock behind real time (no NTP sync); container/VM with drifted clock after suspend/resume; responder clock ahead; deliberate forgery attempting to extend apparent validity; timezone mishandling producing naive-vs-aware datetime comparisons.","solutions":["Synchronize the client clock (NTP/chrony) and retry — client clock drift is the most common cause.","Verify the responder's time source if the client clock is correct and the issue persists.","Inspect ocsp_response.this_update and compare to a trusted time source to determine whether the response or the clock is wrong.","Do not silently accept a future-dated response; treat persistent future timestamps as a trust failure."],"exampleFix":"# before - client clock drifted, OCSP thisUpdate appears 'in the future'\nverifier.is_valid()  # ConnectionError: ocsp certificate was issued in the future\n\n# after - sync the clock, then retry\n# (run) ntpdate / chronyc makestep  OR  systemd-timesyncd restart\nverifier.is_valid()  # now thisUpdate < now, verification proceeds","handlingStrategy":"validation","validationCode":"import datetime, ntplib\n\ndef clock_synced(max_offset_seconds=60):\n    try:\n        resp = ntplib.NTPClient().request('pool.ntp.org', timeout=2)\n        return abs(resp.offset) < max_offset_seconds\n    except Exception:\n        return False  # cannot confirm - do not bypass OCSP on this basis","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    if 'issued in the future' in str(e):\n        logging.warning('OCSP thisUpdate in future - check client NTP sync: %s', e)\n    raise","preventionTips":["Run NTP/chrony on all hosts performing OCSP verification to prevent clock-skew false failures.","After deploy/suspend-resume of VMs/containers, verify time sync before enabling OCSP-checked connections.","Inspect thisUpdate against a trusted time source before treating future timestamps as a real trust problem.","Never bypass a future-timestamp failure without confirming the clock is correct."],"tags":["ocsp","ssl","tls","security","clock-skew","ntp","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}