{"record":{"id":"9fddc19bd34e5f82","repo":"redis/redis-py","slug":"failed-to-valid-ocsp-response","errorCode":null,"errorMessage":"failed to valid ocsp response","messagePattern":"failed to valid ocsp response","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"critical","filePath":"redis/ocsp.py","lineNumber":47,"sourceCode":"                PKCS1v15(),\n                ocsp_response.signature_hash_algorithm,\n            )\n        elif isinstance(pubkey, DSAPublicKey):\n            pubkey.verify(\n                ocsp_response.signature,\n                ocsp_response.tbs_response_bytes,\n                ocsp_response.signature_hash_algorithm,\n            )\n        elif isinstance(pubkey, EllipticCurvePublicKey):\n            pubkey.verify(\n                ocsp_response.signature,\n                ocsp_response.tbs_response_bytes,\n                ECDSA(ocsp_response.signature_hash_algorithm),\n            )\n        else:\n            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)\n    except InvalidSignature:\n        raise ConnectionError(\"failed to valid ocsp response\")\n\n\ndef _check_certificate(issuer_cert, ocsp_bytes, validate=True):\n    \"\"\"A wrapper the return the validity of a known ocsp certificate\"\"\"\n\n    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)\n\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:\n        raise AuthorizationError(\"you are not authorized to view this ocsp certificate\")\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:\n        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:\n            raise ConnectionError(\n                f\"Received an {str(ocsp_response.certificate_status).split('.')[1]} \"\n                \"ocsp certificate status\"\n            )\n    else:\n        raise ConnectionError(\n            \"failed to retrieve a successful response from the ocsp responder\"","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L29-L65","documentation":"Raised as a ConnectionError by _verify_response (redis/ocsp.py:47) when cryptography's pubkey.verify() raises InvalidSignature while checking the OCSP response signature against the issuer (or delegated responder) public key. A failed signature means the response was tampered with, generated by a different key than expected, or corrupted in transit — the OCSP response cannot be trusted. (Note: the message contains a long-standing typo 'valid' instead of 'validate'.)","triggerScenarios":"OCSP verification runs (via ocsp_staple_verifier for stapled responses, or OCSPVerifier.is_valid()/check_certificate() for direct validation) and the responder signature does not validate under the issuer's RSA/DSA/ECDSA public key. _check_certificate calls _verify_response(cert_to_validate, ocsp_response) with validate=True (default), so any signature mismatch surfaces here.","commonSituations":"A man-in-the-middle or compromised responder returning a forged OCSP response; the wrong issuer cert was selected from the chain (mismatched key); response bytes corrupted by a misbehaving proxy/LB; responder rotated its signing key but the chain/issuer used for verification is stale; clock skew combined with a key rotation boundary.","solutions":["Treat this as a security-relevant failure — do not disable OCSP; instead investigate the chain, the responder, and the network path for tampering or a stale issuer.","Confirm the correct issuer certificate is being used for verification (matches peer_cert.issuer) so the right public key validates the signature.","Retry against the OCSP responder directly to rule out transient corruption; a persistent signature failure indicates a real trust problem.","If you must connect while investigating, fall back to a non-OCSP TLS path only after explicitly accepting the risk, and file an incident."],"exampleFix":"# before - OCSP verification enabled, signature mismatch fails the connection\nr = redis.Redis(host=host, port=port, ssl=True, ssl_ocsp_context=...)  # ConnectionError: failed to valid ocsp response\n\n# after - verify issuer chain and responder before re-enabling; keep OCSP on\n# 1. Inspect peer chain to confirm issuer cert selection\n# 2. Fetch the OCSP response manually and verify with cryptography\n# 3. Re-enable ssl_ocsp_context only after signature validates under the correct issuer","handlingStrategy":"try-catch","validationCode":"from cryptography.x509 import ocsp\n\ndef ocsp_response_signature_looks_intact(issuer_cert, ocsp_bytes):\n    # basic precondition: response is loadable and successful before attempting verify\n    resp = ocsp.load_der_ocsp_response(ocsp_bytes)\n    return resp.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    if 'failed to valid ocsp response' in str(e):\n        # signature mismatch - security-relevant; do not silently bypass\n        logging.critical('OCSP signature verification failed: %s', e)\n        raise\n    raise","preventionTips":["Never disable OCSP verification in response to a signature failure — treat it as a potential tampering/MITM indicator.","Confirm the correct issuer cert is selected from the chain before signature verification.","Fetch the OCSP response again to rule out transient corruption.","Keep the cryptography library updated so signature verification follows current algorithm support."],"tags":["ocsp","ssl","tls","security","signature","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}