{"id":"621315f399c07121","repo":"redis/redis-py","slug":"no-issuers-found-in-certificate-chain","errorCode":null,"errorMessage":"no issuers found in certificate chain","messagePattern":"no issuers found in certificate chain","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/ocsp.py","lineNumber":302,"sourceCode":"        }\n        r = requests.get(ocsp_url, headers=header)\n        if not r.ok:\n            raise ConnectionError(\"failed to fetch ocsp certificate\")\n        return _check_certificate(issuer_cert, r.content, True)\n\n    def is_valid(self):\n        \"\"\"Returns the validity of the certificate wrapping our socket.\n        This first retrieves for validate the certificate, issuer_url,\n        and ocsp_server for certificate validate. Then retrieves the\n        issuer certificate from the issuer_url, and finally checks\n        the validity of OCSP revocation status.\n        \"\"\"\n\n        # validate the certificate\n        try:\n            cert, issuer_url, ocsp_server = self.components_from_socket()\n            if issuer_url is None:\n                raise ConnectionError(\"no issuers found in certificate chain\")\n            return self.check_certificate(ocsp_server, cert, issuer_url)\n        except AuthorizationError:\n            cert, issuer_url, ocsp_server = self.components_from_direct_connection()\n            if issuer_url is None:\n                raise ConnectionError(\"no issuers found in certificate chain\")\n            return self.check_certificate(ocsp_server, cert, issuer_url)\n","sourceCodeStart":284,"sourceCodeEnd":309,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/ocsp.py#L284-L309","documentation":"Raised by OCSPValidator.is_valid (redis/ocsp.py:302) on the primary code path. OCSP validation needs the issuer certificate to verify the server cert's revocation status; the issuer URL is read from the cert's Authority Information Access (AIA) CA Issuers entry. If components_from_socket() returns issuer_url is None (the AIA extension has no CA_ISSUERS access method), the library raises redis.exceptions.ConnectionError because it cannot fetch the issuer certificate required to build the OCSP request.","triggerScenarios":"Connecting with TLS + OCSP validation enabled (ssl_ocsp_context set) where the server certificate presented on the TLS socket has an AIA extension lacking a CA Issuers URL, or has no AIA extension entry for CA_ISSUERS. The branch is reached when self.components_from_socket() succeeds but returns issuer_url=None.","commonSituations":"Self-signed certificates; certificates issued by a private/internal CA that does not populate AIA extensions; certificates where only the OCSP responder URL is present but the CA Issuers URL is omitted; lab/staging environments with minimalist cert generation.","solutions":["Disable OCSP validation (remove ssl_ocsp_context) if your PKI does not provide AIA CA Issuers URLs.","Re-issue the server certificate with a complete AIA extension containing both OCSP and CA Issuers URLs.","Use a public CA-issued certificate that includes AIA CA Issuers information."],"exampleFix":"# before\nclient = redis.Redis(host='...', ssl=True, ssl_ocsp_context=ctx)\n# after\nclient = redis.Redis(host='...', ssl=True)","handlingStrategy":"validation","validationCode":"from cryptography import x509\nfrom cryptography.hazmat.backends import default_backend\n\ndef cert_has_issuer_aia(cert_pem: bytes) -> bool:\n    cert = x509.load_pem_x509_certificate(cert_pem, default_backend())\n    try:\n        aia = cert.extensions.get_extension_for_oid(\n            x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS\n        ).value\n    except x509.extensions.ExtensionNotFound:\n        return False\n    return any(\n        d.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS\n        for d in aia\n    )\n\n# Only enable OCSP if the cert supports it\nctx = ocsp_ctx if cert_has_issuer_aia(server_cert_pem) else None","typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError as RedisConnectionError\n\ntry:\n    client = redis.Redis(host=HOST, port=PORT, ssl=True, ssl_ocsp_context=ctx)\n    client.ping()\nexcept RedisConnectionError as e:\n    if 'no issuers found in certificate chain' in str(e):\n        client = redis.Redis(host=HOST, port=PORT, ssl=True)  # drop OCSP\n    else:\n        raise","preventionTips":["Inspect certs with `openssl x509 -in cert.pem -noout -text | grep -A2 'Authority Information Access'` before enabling OCSP.","Prefer public CA-issued certificates that include complete AIA extensions.","Document which deployments require OCSP and which certs satisfy the requirement."],"tags":["tls","ocsp","ssl","certificate","security","pki"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}