{"record":{"id":"a149004607dd8801","repo":"redis/redis-py","slug":"received-an-str-ocsp-response-certificate-status","errorCode":null,"errorMessage":"Received an {str(ocsp_response.certificate_status).split('.')[1]} ocsp certificate status","messagePattern":"Received an (.+?) ocsp certificate status","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"critical","filePath":"redis/ocsp.py","lineNumber":59,"sourceCode":"                ocsp_response.tbs_response_bytes,\n                ECDSA(ocsp_response.signature_hash_algorithm),\n            )\n        else:\n            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)\n    except InvalidSignature:\n        raise ConnectionError(\"failed to valid ocsp response\")\n\n\ndef _check_certificate(issuer_cert, ocsp_bytes, validate=True):\n    \"\"\"A wrapper the return the validity of a known ocsp certificate\"\"\"\n\n    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)\n\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:\n        raise AuthorizationError(\"you are not authorized to view this ocsp certificate\")\n    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:\n        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:\n            raise ConnectionError(\n                f\"Received an {str(ocsp_response.certificate_status).split('.')[1]} \"\n                \"ocsp certificate status\"\n            )\n    else:\n        raise ConnectionError(\n            \"failed to retrieve a successful response from the ocsp responder\"\n        )\n\n    if ocsp_response.this_update >= datetime.datetime.now():\n        raise ConnectionError(\"ocsp certificate was issued in the future\")\n\n    if (\n        ocsp_response.next_update\n        and ocsp_response.next_update < datetime.datetime.now()\n    ):\n        raise ConnectionError(\"ocsp certificate has invalid update - in the past\")\n\n    responder_name = ocsp_response.responder_name","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/ocsp.py#L41-L77","documentation":"Raised as a ConnectionError by _check_certificate (redis/ocsp.py:59) when the OCSP response_status is SUCCESSFUL but certificate_status is not GOOD — i.e. REVOKED or UNKNOWN. The f-string extracts the lowercase status name by splitting the enum's str representation on '.' (so OCSPCertStatus.REVOKED becomes 'revoked'), producing messages like 'Received an revoked ocsp certificate status'. A non-GOOD status means the certificate is either provably revoked or its status cannot be determined.","triggerScenarios":"OCSP verification completes and the responder returns SUCCESSFUL/REVOKED (certificate has been revoked) or SUCCESSFUL/UNKNOWN (responder has no information). Either case is treated as a connection-blocking condition.","commonSituations":"Certificate revoked due to compromise or rotation but the client still references it; a stale cached cert after key rotation; responder returns UNKNOWN because it has no record for that serial (misconfigured responder, or cert from a different hierarchy); intermediate CA issue causing transient UNKNOWN responses.","solutions":["If REVOKED: rotate the client/server certificate immediately — a revoked certificate must not be used; this is a security event.","If UNKNOWN: retry to rule out a transient responder issue; persistent UNKNOWN means the responder lacks coverage for this cert and you should use a covered responder or CRL.","Verify the certificate serial/subject matches an active, non-revoked certificate in your PKI.","Update the configured CA certs and confirm the OCSP responder authoritative for the issuing CA is the one being queried."],"exampleFix":"# before - OCSP says revoked, connection blocked\nverifier.is_valid()  # ConnectionError: Received an revoked ocsp certificate status\n\n# after - rotate the certificate to a valid, non-revoked one\n# 1. Issue a new certificate from the CA\n# 2. Deploy new cert/key to the server\n# 3. Point the client at the updated endpoint and re-enable OCSP","handlingStrategy":"try-catch","validationCode":"from cryptography.x509 import ocsp\n\ndef certificate_status_is_good(ocsp_bytes):\n    resp = ocsp.load_der_ocsp_response(ocsp_bytes)\n    return (\n        resp.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL\n        and resp.certificate_status == ocsp.OCSPCertStatus.GOOD\n    )","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    verifier.is_valid()\nexcept RedisConnectionError as e:\n    msg = str(e)\n    if 'revoked' in msg:\n        logging.critical('Certificate is REVOKED - rotate immediately: %s', e)\n        raise\n    if 'unknown' in msg:\n        logging.warning('OCSP status UNKNOWN - retry or use alternate responder: %s', e)\n    raise","preventionTips":["Track certificate expiration and rotation proactively so you never rely on a revoked cert.","For UNKNOWN statuses, retry and have an alternate OCSP responder or CRL configured.","Alert on REVOKED status as a security incident.","Keep CA and responder coverage aligned with the certificates you issue."],"tags":["ocsp","ssl","tls","security","revoked","certificate","connection"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}