{"record":{"id":"9691f4d600d4ba86","repo":"redis/redis-py","slug":"invalid-ssl-certificate-requirements-flag-cert-r","errorCode":null,"errorMessage":"Invalid SSL Certificate Requirements Flag: {cert_reqs}","messagePattern":"Invalid SSL Certificate Requirements Flag: (.+?)","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/asyncio/connection.py","lineNumber":1641,"sourceCode":"        min_version: Optional[TLSVersion] = None,\n        ciphers: Optional[str] = None,\n        password: Optional[str] = None,\n    ):\n        if not SSL_AVAILABLE:\n            raise RedisError(\"Python wasn't built with SSL support\")\n\n        self.keyfile = keyfile\n        self.certfile = certfile\n        if cert_reqs is None:\n            cert_reqs = ssl.CERT_NONE\n        elif isinstance(cert_reqs, str):\n            CERT_REQS = {  # noqa: N806\n                \"none\": ssl.CERT_NONE,\n                \"optional\": ssl.CERT_OPTIONAL,\n                \"required\": ssl.CERT_REQUIRED,\n            }\n            if cert_reqs not in CERT_REQS:\n                raise RedisError(\n                    f\"Invalid SSL Certificate Requirements Flag: {cert_reqs}\"\n                )\n            cert_reqs = CERT_REQS[cert_reqs]\n        self.cert_reqs = cert_reqs\n        self.include_verify_flags = include_verify_flags\n        self.exclude_verify_flags = exclude_verify_flags\n        self.ca_certs = ca_certs\n        self.ca_data = ca_data\n        self.ca_path = ca_path\n        self.check_hostname = (\n            check_hostname if self.cert_reqs != ssl.CERT_NONE else False\n        )\n        self.min_version = min_version\n        self.ciphers = ciphers\n        self.password = password\n        self.context: Optional[SSLContext] = None\n\n    def get(self) -> SSLContext:","sourceCodeStart":1623,"sourceCodeEnd":1659,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/asyncio/connection.py#L1623-L1659","documentation":"Raised as RedisError inside RedisSSLContext.__init__ when ssl_cert_reqs is passed as a string that is not one of 'none', 'optional', or 'required' (case-sensitive lowercase keys). The mapping is fixed; any other string value aborts context construction before the SSLContext is created.","triggerScenarios":"Passing ssl_cert_reqs='CERT_REQUIRED', 'Required', 'yes', '1', or any non-canonical token. Common via from_url with ssl_cert_reqs=<wrong> in the query string, or by passing the ssl module constant's string repr.","commonSituations":"Confusing ssl.CERT_REQUIRED (int 2) with the string 'CERT_REQUIRED'; copy-pasting a config that used the enum name instead of the library's lowercase keyword; typos; case mismatch ('Required' vs 'required').","solutions":["Use one of the exact lowercase strings: 'none', 'optional', or 'required'.","Or pass the ssl module constant directly: ssl_cert_reqs=ssl.CERT_REQUIRED.","Double-check the value when it comes from env/config: normalize to lowercase before passing."],"exampleFix":"// before\nr = redis.asyncio.Redis(host=h, ssl=True, ssl_cert_reqs='CERT_REQUIRED')\n// after\nimport ssl\nr = redis.asyncio.Redis(host=h, ssl=True, ssl_cert_reqs='required')  # or ssl.CERT_REQUIRED","handlingStrategy":"validation","validationCode":"import ssl\n\n_VALID = {'none': ssl.CERT_NONE, 'optional': ssl.CERT_OPTIONAL, 'required': ssl.CERT_REQUIRED}\n\ndef normalize_cert_reqs(v: str) -> str:\n    if isinstance(v, str) and v.lower() in _VALID:\n        return v.lower()\n    raise ValueError(f\"cert_reqs must be one of {sorted(_VALID)}\")","typeGuard":"from redis.exceptions import RedisError\n\ndef is_bad_cert_reqs(exc: BaseException) -> bool:\n    return isinstance(exc, RedisError) and 'Certificate Requirements Flag' in str(exc)","tryCatchPattern":"from redis.exceptions import RedisError\n\nfor candidate in ('required', ssl.CERT_REQUIRED):\n    try:\n        r = redis.asyncio.Redis(host=h, ssl=True, ssl_cert_reqs=candidate)\n        break\n    except RedisError as e:\n        if 'Certificate Requirements Flag' not in str(e):\n            raise","preventionTips":["Use exact lowercase 'none'|'optional'|'required' or pass the ssl constant.","Normalize config values to lowercase before passing.","Unit-test SSL config with each code path."],"tags":["ssl","config","cert-reqs","validation","async"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}