{"record":{"id":"a842d3fb2509205c","repo":"redis/redis-py","slug":"cryptography-is-not-installed","errorCode":null,"errorMessage":"cryptography is not installed.","messagePattern":"cryptography is not installed\\.","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2218,"sourceCode":"            context.load_cert_chain(\n                certfile=self.certfile,\n                keyfile=self.keyfile,\n                password=self.certificate_password,\n            )\n        if (\n            self.ca_certs is not None\n            or self.ca_path is not None\n            or self.ca_data is not None\n        ):\n            context.load_verify_locations(\n                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data\n            )\n        if self.ssl_min_version is not None:\n            context.minimum_version = self.ssl_min_version\n        if self.ssl_ciphers:\n            context.set_ciphers(self.ssl_ciphers)\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:\n            raise RedisError(\"cryptography is not installed.\")\n\n        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:\n            raise RedisError(\n                \"Either an OCSP staple or pure OCSP connection must be validated \"\n                \"- not both.\"\n            )\n\n        sslsock = context.wrap_socket(sock, server_hostname=self.host)\n\n        # validation for the stapled case\n        if self.ssl_validate_ocsp_stapled:\n            import OpenSSL\n\n            from .ocsp import ocsp_staple_verifier\n\n            # if a context is provided use it - otherwise, a basic context\n            if self.ssl_ocsp_context is None:\n                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)","sourceCodeStart":2200,"sourceCodeEnd":2236,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2200-L2236","documentation":"Raised in SSLConnection._wrap_socket_with_ssl when ssl_validate_ocsp is True but the optional cryptography package is not installed (CRYPTOGRAPHY_AVAILABLE is False). Pure (non-stapled) OCSP validation needs the cryptography library to parse and verify the OCSP response; without it the check cannot run. Install the ocsp extra or the cryptography package directly.","triggerScenarios":"Constructing a client with ssl_validate_ocsp=True on an environment that lacks the cryptography package. The error surfaces only when a real connection is opened (_wrap_socket_with_ssl), not at client construction.","commonSituations":"Enabling OCSP validation in production without adding the ocsp extra to requirements. Minimal CI images that exclude cryptography. Enabling ssl_validate_ocsp after a dependency cleanup.","solutions":["Install cryptography: pip install cryptography (or pip install redis[ocsp]).","If you only have a stapled OCSP response to verify, use ssl_validate_ocsp_stapled=True instead, which uses pyOpenSSL rather than cryptography.","Disable OCSP validation (ssl_validate_ocsp=False) if it is not required by your security policy."],"exampleFix":"# before - raises when connection opens\nr = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)\n# after\npip install redis[ocsp]\nr = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)","handlingStrategy":"validation","validationCode":"try:\n    import cryptography  # noqa: F401\n    crypto_ok = True\nexcept ImportError:\n    crypto_ok = False\n\nif user_wants_ocsp and not crypto_ok:\n    raise RuntimeError('ssl_validate_ocsp=True requires the cryptography package; pip install redis[ocsp]')\n\nr = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=user_wants_ocsp)","typeGuard":"def cryptography_available() -> bool:\n    try:\n        import cryptography  # noqa: F401\n        return True\n    except ImportError:\n        return False","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)\n    r.ping()\nexcept RedisError as e:\n    if 'cryptography is not installed' in str(e):\n        # fall back to stapled OCSP (pyOpenSSL) or disable pure OCSP\n        r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp_stapled=True)\n    else:\n        raise","preventionTips":["Add redis[ocsp] (or cryptography) to requirements whenever you enable ssl_validate_ocsp.","Pin cryptography in CI images that run OCSP checks.","Use stapled OCSP if you cannot install cryptography."],"tags":["ssl","ocsp","dependency","configuration"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}