{"record":{"id":"dc752fd46692768e","repo":"redis/redis-py","slug":"invalid-ssl-verify-flag-flag","errorCode":null,"errorMessage":"Invalid ssl verify flag: {flag}","messagePattern":"Invalid ssl verify flag: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"redis/asyncio/connection.py","lineNumber":1732,"sourceCode":"\ndef to_bool(value) -> Optional[bool]:\n    if value is None or value == \"\":\n        return None\n    if isinstance(value, str) and value.upper() in FALSE_STRINGS:\n        return False\n    return bool(value)\n\n\ndef parse_ssl_verify_flags(value):\n    # flags are passed in as a string representation of a list,\n    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN\n    verify_flags_str = value.replace(\"[\", \"\").replace(\"]\", \"\")\n\n    verify_flags = []\n    for flag in verify_flags_str.split(\",\"):\n        flag = flag.strip()\n        if not hasattr(VerifyFlags, flag):\n            raise ValueError(f\"Invalid ssl verify flag: {flag}\")\n        verify_flags.append(getattr(VerifyFlags, flag))\n    return verify_flags\n\n\nURL_QUERY_ARGUMENT_PARSERS: Mapping[str, Callable[..., object]] = MappingProxyType(\n    {\n        \"db\": int,\n        \"socket_timeout\": float,\n        \"socket_connect_timeout\": float,\n        \"socket_read_size\": int,\n        \"socket_keepalive\": to_bool,\n        \"retry_on_timeout\": to_bool,\n        \"max_connections\": int,\n        \"health_check_interval\": int,\n        \"ssl_check_hostname\": to_bool,\n        \"ssl_include_verify_flags\": parse_ssl_verify_flags,\n        \"ssl_exclude_verify_flags\": parse_ssl_verify_flags,\n        \"ssl_min_version\": int,","sourceCodeStart":1714,"sourceCodeEnd":1750,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/asyncio/connection.py#L1714-L1750","documentation":"Raised as ValueError from parse_ssl_verify_flags() when a token in the parsed verify-flags list is not an attribute of ssl.VerifyFlags. The function strips brackets, splits on comma, and validates each token via hasattr(VerifyFlags, flag). Any unknown name (including typos or version-mismatched constants) raises before the connection is built.","triggerScenarios":"Passing ssl_include_verify_flags / ssl_exclude_verify_flags through from_url as a query string like ?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_BOGUS, or passing a malformed list. Any token not present on the installed Python's ssl.VerifyFlags raises.","commonSituations":"Typo in a flag name; using a flag constant that exists in a newer Python (e.g. VERIFY_X509_PARTIAL_CHAIN) on an older interpreter; copy-pasting the C-level constant name instead of the Python attribute.","solutions":["List the valid flags on your Python: python -c 'import ssl; print([x for x in dir(ssl.VerifyFlags) if not x.startswith(\"_\")])' and use only those names.","Pass ssl.VerifyFlags constants directly as a list (not a URL string) to avoid parsing pitfalls.","Drop the unsupported flag if your Python version lacks it."],"exampleFix":"// before\nr = redis.asyncio.from_url('rediss://host?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_BOGUS')\n// after\nimport ssl\nr = redis.asyncio.Redis(host=h, ssl=True, ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_STRICT])","handlingStrategy":"validation","validationCode":"import ssl\n\ndef valid_verify_flags(names: list[str]) -> list:\n    valid = {x for x in dir(ssl.VerifyFlags) if not x.startswith('_')}\n    bad = [n for n in names if n not in valid]\n    if bad:\n        raise ValueError(f'Unsupported VerifyFlags: {bad}; valid: {sorted(valid)}')\n    return [getattr(ssl.VerifyFlags, n) for n in names]","typeGuard":"def is_bad_verify_flag(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and 'ssl verify flag' in str(exc).lower()","tryCatchPattern":"from redis.asyncio.connection import parse_ssl_verify_flags\n\ntry:\n    flags = parse_ssl_verify_flags(raw)\nexcept ValueError as e:\n    if 'ssl verify flag' in str(e).lower():\n        flags = []  # or fall back to ssl.VerifyFlags constants\n    else:\n        raise","preventionTips":["Enumerate valid flags with dir(ssl.VerifyFlags) before constructing the URL.","Pass ssl.VerifyFlags constants directly instead of URL strings.","Pin Python version so the flag set is known."],"tags":["ssl","verify-flags","config","validation","async","url"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}