{"record":{"id":"a5d3ece93564ca4c","repo":"redis/redis-py","slug":"either-an-ocsp-staple-or-pure-ocsp-connection-must","errorCode":null,"errorMessage":"Either an OCSP staple or pure OCSP connection must be validated - not both.","messagePattern":"Either an OCSP staple or pure OCSP connection must be validated - not both\\.","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2221,"sourceCode":"                password=self.certificate_password,\n            )\n        if (\n            self.ca_certs is not None\n            or self.ca_path is not None\n            or self.ca_data is not None\n        ):\n            context.load_verify_locations(\n                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data\n            )\n        if self.ssl_min_version is not None:\n            context.minimum_version = self.ssl_min_version\n        if self.ssl_ciphers:\n            context.set_ciphers(self.ssl_ciphers)\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:\n            raise RedisError(\"cryptography is not installed.\")\n\n        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:\n            raise RedisError(\n                \"Either an OCSP staple or pure OCSP connection must be validated \"\n                \"- not both.\"\n            )\n\n        sslsock = context.wrap_socket(sock, server_hostname=self.host)\n\n        # validation for the stapled case\n        if self.ssl_validate_ocsp_stapled:\n            import OpenSSL\n\n            from .ocsp import ocsp_staple_verifier\n\n            # if a context is provided use it - otherwise, a basic context\n            if self.ssl_ocsp_context is None:\n                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)\n                staple_ctx.use_certificate_file(self.certfile)\n                staple_ctx.use_privatekey_file(self.keyfile)\n            else:","sourceCodeStart":2203,"sourceCodeEnd":2239,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2203-L2239","documentation":"Raised in SSLConnection._wrap_socket_with_ssl when both ssl_validate_ocsp and ssl_validate_ocsp_stapled are True. The two OCSP modes are mutually exclusive: pure OCSP validates by contacting an OCSP responder (needs cryptography), while stapled OCSP validates a certificate-status response the server attaches to the handshake (uses pyOpenSSL). You must pick exactly one.","triggerScenarios":"Constructing a connection with both ssl_validate_ocsp=True and ssl_validate_ocsp_stapled=True. Copying two OCSP flags from documentation without realizing they conflict.","commonSituations":"Over-eager TLS hardening that enables every OCSP-related flag. Merging configs from multiple examples. Automation that turns on 'all' ssl validation knobs.","solutions":["Keep exactly one: ssl_validate_ocsp=True (pure, contacts responder) OR ssl_validate_ocsp_stapled=True (uses server-stapled response).","Set both to False if OCSP validation is not required.","Audit your SSL config builder to ensure the two flags are never toggled together."],"exampleFix":"# before\nr = redis.Redis(ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)\n# after\nr = redis.Redis(ssl_validate_ocsp_stapled=True)","handlingStrategy":"validation","validationCode":"if ssl_validate_ocsp and ssl_validate_ocsp_stapled:\n    raise ValueError('Enable exactly one of ssl_validate_ocsp / ssl_validate_ocsp_stapled')\nr = redis.Redis(ssl_validate_ocsp=ssl_validate_ocsp,\n               ssl_validate_ocsp_stapled=ssl_validate_ocsp_stapled)","typeGuard":"def ocsp_flags_consistent(pure: bool, stapled: bool) -> bool:\n    return not (pure and stapled)","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    r = redis.Redis(ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)\nexcept RedisError:\n    # pick one mode\n    r = redis.Redis(ssl_validate_ocsp_stapled=True)","preventionTips":["Treat the two OCSP flags as mutually exclusive in config schemas.","Default both to False and let users opt into exactly one.","Add a config lint rule that rejects both-true."],"tags":["ssl","ocsp","configuration"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}