{"record":{"id":"8626a88f67bbede9","repo":"redis/redis-py","slug":"invalid-ssl-verify-flag-flag-8626a8","errorCode":null,"errorMessage":"Invalid ssl verify flag: {flag}","messagePattern":"Invalid ssl verify flag: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2321,"sourceCode":"\ndef to_bool(value):\n    if value is None or value == \"\":\n        return None\n    if isinstance(value, str) and value.upper() in FALSE_STRINGS:\n        return False\n    return bool(value)\n\n\ndef parse_ssl_verify_flags(value):\n    # flags are passed in as a string representation of a list,\n    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN\n    verify_flags_str = value.replace(\"[\", \"\").replace(\"]\", \"\")\n\n    verify_flags = []\n    for flag in verify_flags_str.split(\",\"):\n        flag = flag.strip()\n        if not hasattr(VerifyFlags, flag):\n            raise ValueError(f\"Invalid ssl verify flag: {flag}\")\n        verify_flags.append(getattr(VerifyFlags, flag))\n    return verify_flags\n\n\nURL_QUERY_ARGUMENT_PARSERS = {\n    \"db\": int,\n    \"socket_timeout\": float,\n    \"socket_connect_timeout\": float,\n    \"socket_read_size\": int,\n    \"socket_keepalive\": to_bool,\n    \"retry_on_timeout\": to_bool,\n    \"retry_on_error\": list,\n    \"max_connections\": int,\n    \"health_check_interval\": int,\n    \"ssl_check_hostname\": to_bool,\n    \"ssl_include_verify_flags\": parse_ssl_verify_flags,\n    \"ssl_exclude_verify_flags\": parse_ssl_verify_flags,\n    \"ssl_min_version\": int,","sourceCodeStart":2303,"sourceCodeEnd":2339,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2303-L2339","documentation":"Raised as ValueError(f'Invalid ssl verify flag: {flag}') by parse_ssl_verify_flags, which is the URL-query parser for ssl_include_verify_flags and ssl_exclude_verify_flags. Each comma-separated token must be an attribute name on ssl.VerifyFlags (e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN). A token that is not such an attribute is rejected.","triggerScenarios":"Passing a rediss:// URL with ?ssl_include_verify_flags=VERIFY_X509_TRUSTED_FIRST (not a real flag) or ?ssl_include_verify_flags=verify_x509_strict (wrong case). Typos in flag names in the query string.","commonSituations":"Hand-typed connection URLs with verify-flag query params. Copying flag names from outdated docs. Case mismatch (the flags are uppercase). Passing flags valid for a different OpenSSL binding.","solutions":["Use only valid ssl.VerifyFlags attribute names (run [name for name in dir(ssl.VerifyFlags) if name.startswith('VERIFY_')] to list them).","Keep the names uppercase and comma-separated, e.g. ?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_X509_PARTIAL_CHAIN.","If you do not need custom verify flags, omit the query parameter entirely."],"exampleFix":"# before\nr = redis.Redis.from_url('rediss://host?ssl_include_verify_flags=VERIFY_STRICT')\n# after\nr = redis.Redis.from_url('rediss://host?ssl_include_verify_flags=VERIFY_X509_STRICT')","handlingStrategy":"validation","validationCode":"import ssl\n\ndef valid_verify_flags(flags_csv: str) -> bool:\n    names = {n for n in dir(ssl.VerifyFlags) if n.startswith('VERIFY_')}\n    return all(f.strip() in names for f in flags_csv.replace('[', '').replace(']', '').split(',') if f.strip())","typeGuard":"import ssl\n\ndef is_valid_flag_token(token: str) -> bool:\n    return hasattr(ssl.VerifyFlags, token)","tryCatchPattern":"try:\n    r = redis.Redis.from_url(url_with_flags)\nexcept ValueError as e:\n    if 'Invalid ssl verify flag' in str(e):\n        # strip the flags param and retry with defaults\n        r = redis.Redis.from_url(url_without_flags)\n    else:\n        raise","preventionTips":["Source flag names programmatically from dir(ssl.VerifyFlags).","Keep flag tokens uppercase and comma-separated.","Avoid hand-typing verify flags in URLs."],"tags":["ssl","configuration","url-parsing","validation"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}