{"record":{"id":"f4a11ba972cf29be","repo":"redis/redis-py","slug":"ocsp-validation-error","errorCode":null,"errorMessage":"ocsp validation error","messagePattern":"ocsp validation error","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2262,"sourceCode":"            )\n\n            #  need another socket\n            con = OpenSSL.SSL.Connection(staple_ctx, socket.socket())\n            con.request_ocsp()\n            con.connect((self.host, self.port))\n            con.do_handshake()\n            con.shutdown()\n            return sslsock\n\n        # pure ocsp validation\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE:\n            from .ocsp import OCSPVerifier\n\n            o = OCSPVerifier(sslsock, self.host, self.port, self.ca_certs)\n            if o.is_valid():\n                return sslsock\n            else:\n                raise ConnectionError(\"ocsp validation error\")\n        return sslsock\n\n\nclass UnixDomainSocketConnection(AbstractConnection):\n    \"Manages UDS communication to and from a Redis server\"\n\n    def __init__(self, path=\"\", socket_timeout=DEFAULT_SOCKET_TIMEOUT, **kwargs):\n        super().__init__(**kwargs)\n        self.path = path\n        self.socket_timeout = socket_timeout\n\n    def repr_pieces(self):\n        pieces = [(\"path\", self.path), (\"db\", self.db)]\n        if self.client_name:\n            pieces.append((\"client_name\", self.client_name))\n        return pieces\n\n    def _connect(self):","sourceCodeStart":2244,"sourceCodeEnd":2280,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/connection.py#L2244-L2280","documentation":"Raised as ConnectionError('ocsp validation error') in SSLConnection._wrap_socket_with_ssl after OCSPVerifier.is_valid() returns False. This means the pure-OCSP validation (ssl_validate_ocsp=True with cryptography installed) ran and concluded the certificate is invalid/revoked or the responder could not be reached in a way the verifier treats as failure. The socket is rejected, so the TLS connection is never established.","triggerScenarios":"Connecting with ssl_validate_ocsp=True against a server whose certificate has been revoked, whose OCSP responder is unreachable/misconfigured, or whose chain cannot be verified by OCSPVerifier.","commonSituations":"Certificate actually revoked. OCSP responder blocked by a firewall or behind a proxy. Stale/incorrect ca_certs passed to the verifier. Transient responder outage during deployment.","solutions":["Check the certificate's real revocation status (openssl ocsp) to distinguish a revoked cert from a responder-side problem.","Ensure the host running redis-py can reach the OCSP responder URL embedded in the certificate chain.","Verify ca_certs/ssl_ca_certs point to the correct CA bundle.","If the responder is temporarily down and your policy allows it, disable pure OCSP (ssl_validate_ocsp=False) or switch to stapled validation."],"exampleFix":"# before\nr = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)\n# after - verify with openssl first; if responder is just unreachable, use stapled\nr = redis.Redis.from_url('rediss://host', ssl_validate_ocsp_stapled=True)","handlingStrategy":"try-catch","validationCode":"# No purely local validation can prove OCSP validity, but you can preflight reachability\n# of the responder URL from the cert chain before connecting:\n# 1) fetch the cert with openssl s_client, 2) parse OCSP URI, 3) probe the responder.\n# At minimum, ensure ca_certs resolve:\nimport os\nassert os.path.exists(ca_certs_path), 'ca_certs file missing'","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError\nfor attempt in range(3):\n    try:\n        r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)\n        r.ping()\n        break\n    except ConnectionError as e:\n        if 'ocsp validation error' in str(e):\n            # investigate: revoked cert vs responder outage; do not blindly trust\n            raise\n        continue","preventionTips":["Monitor OCSP responder reachability from the hosts running redis-py.","Keep ca_certs/ssl_ca_certs current.","Distinguish revoked certs (do not bypass) from responder outages (consider stapled fallback)."],"tags":["ssl","ocsp","security","network"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}