{"record":{"id":"aae86099ee6a86b6","repo":"redis/redis-py","slug":"invalid-ssl-certificate-requirements-flag-ssl-ce","errorCode":null,"errorMessage":"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}","messagePattern":"Invalid SSL Certificate Requirements Flag: (.+?)","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2147,"sourceCode":"\n        Raises:\n            RedisError\n        \"\"\"  # noqa\n        if not SSL_AVAILABLE:\n            raise RedisError(\"Python wasn't built with SSL support\")\n\n        self.keyfile = ssl_keyfile\n        self.certfile = ssl_certfile\n        if ssl_cert_reqs is None:\n            ssl_cert_reqs = ssl.CERT_NONE\n        elif isinstance(ssl_cert_reqs, str):\n            CERT_REQS = {  # noqa: N806\n                \"none\": ssl.CERT_NONE,\n                \"optional\": ssl.CERT_OPTIONAL,\n                \"required\": ssl.CERT_REQUIRED,\n            }\n            if ssl_cert_reqs not in CERT_REQS:\n                raise RedisError(\n                    f\"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}\"\n                )\n            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]\n        self.cert_reqs = ssl_cert_reqs\n        self.ssl_include_verify_flags = ssl_include_verify_flags\n        self.ssl_exclude_verify_flags = ssl_exclude_verify_flags\n        self.ca_certs = ssl_ca_certs\n        self.ca_data = ssl_ca_data\n        self.ca_path = ssl_ca_path\n        self.check_hostname = (\n            ssl_check_hostname if self.cert_reqs != ssl.CERT_NONE else False\n        )\n        self.certificate_password = ssl_password\n        self.ssl_validate_ocsp = ssl_validate_ocsp\n        self.ssl_validate_ocsp_stapled = ssl_validate_ocsp_stapled\n        self.ssl_ocsp_context = ssl_ocsp_context\n        self.ssl_ocsp_expected_cert = ssl_ocsp_expected_cert\n        self.ssl_min_version = ssl_min_version","sourceCodeStart":2129,"sourceCodeEnd":2165,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2129-L2165","documentation":"Raised in SSLConnection.__init__ when ssl_cert_reqs is passed as a string that is not one of the recognized keys ('none', 'optional', 'required'). The constructor maps those strings to ssl.CERT_NONE / ssl.CERT_OPTIONAL / ssl.CERT_REQUIRED; any other string value is rejected. Passing the ssl constant directly (e.g. ssl.CERT_REQUIRED) bypasses string parsing and never triggers this.","triggerScenarios":"Calling SSLConnection(..., ssl_cert_reqs='require') (typo) or ssl_cert_reqs='CERT_REQUIRED' (the constant name rather than the keyword). Passing an arbitrary lowercase token not in the allowlist.","commonSituations":"Confusion between the string keyword ('required') and the ssl module constant name ('CERT_REQUIRED'). Typos in config files or env vars fed into ssl_cert_reqs. Copy-pasting cert-req names from other libraries.","solutions":["Use one of the exact strings 'none', 'optional', or 'required' (case-sensitive).","Pass the ssl constant directly: import ssl; ssl_cert_reqs=ssl.CERT_REQUIRED.","If the value comes from config, validate it against {'none','optional','required'} before constructing the client."],"exampleFix":"# before\nr = redis.Redis(ssl_cert_reqs='CERT_REQUIRED')\n# after\nimport ssl\nr = redis.Redis(ssl_cert_reqs=ssl.CERT_REQUIRED)\n# or\nr = redis.Redis(ssl_cert_reqs='required')","handlingStrategy":"validation","validationCode":"import ssl\n\n_ALLOWED = {'none': ssl.CERT_NONE, 'optional': ssl.CERT_OPTIONAL, 'required': ssl.CERT_REQUIRED}\n\ndef resolve_cert_reqs(value):\n    if value is None:\n        return ssl.CERT_NONE\n    if isinstance(value, str) and value in _ALLOWED:\n        return _ALLOWED[value]\n    if isinstance(value, int):\n        return value\n    raise ValueError(f'Invalid ssl_cert_reqs: {value!r}')\n\nr = redis.Redis(ssl_cert_reqs=resolve_cert_reqs(cfg['ssl_cert_reqs']))","typeGuard":"import ssl\n\ndef is_valid_cert_reqs(value) -> bool:\n    if value is None:\n        return True\n    if isinstance(value, int):\n        return value in (ssl.CERT_NONE, ssl.CERT_OPTIONAL, ssl.CERT_REQUIRED)\n    return isinstance(value, str) and value in ('none', 'optional', 'required')","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    r = redis.Redis(ssl_cert_reqs=user_value)\nexcept RedisError as e:\n    if 'Invalid SSL Certificate Requirements Flag' in str(e):\n        user_value = 'required'  # fall back to a safe default\n        r = redis.Redis(ssl_cert_reqs=user_value)\n    else:\n        raise","preventionTips":["Prefer passing ssl.CERT_REQUIRED directly over a string.","Whitelist config values to {'none','optional','required'}.","Validate config before constructing the client."],"tags":["ssl","configuration","validation"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}