{"id":"72183205c5581fcb","repo":"redis/redis-py","slug":"python-wasn-t-built-with-ssl-support-721832","errorCode":null,"errorMessage":"Python wasn't built with SSL support","messagePattern":"Python wasn't built with SSL support","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"critical","filePath":"redis/connection.py","lineNumber":2118,"sourceCode":"            ssl_exclude_verify_flags: A list of flags to be excluded from the SSLContext.verify_flags. Defaults to None.\n            ssl_ca_certs: The path to a file of concatenated CA certificates in PEM format. Defaults to None.\n            ssl_ca_data: Either an ASCII string of one or more PEM-encoded certificates or a bytes-like object of DER-encoded certificates.\n            ssl_check_hostname: If set, match the hostname during the SSL handshake. Defaults to True.\n            ssl_ca_path: The path to a directory containing several CA certificates in PEM format. Defaults to None.\n            ssl_password: Password for unlocking an encrypted private key. Defaults to None.\n\n            ssl_validate_ocsp: If set, perform a full ocsp validation (i.e not a stapled verification)\n            ssl_validate_ocsp_stapled: If set, perform a validation on a stapled ocsp response\n            ssl_ocsp_context: A fully initialized OpenSSL.SSL.Context object to be used in verifying the ssl_ocsp_expected_cert\n            ssl_ocsp_expected_cert: A PEM armoured string containing the expected certificate to be returned from the ocsp verification service.\n            ssl_min_version: The lowest supported SSL version. It affects the supported SSL versions of the SSLContext. None leaves the default provided by ssl module.\n            ssl_ciphers: A string listing the ciphers that are allowed to be used. Defaults to None, which means that the default ciphers are used. See https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers for more information.\n\n        Raises:\n            RedisError\n        \"\"\"  # noqa\n        if not SSL_AVAILABLE:\n            raise RedisError(\"Python wasn't built with SSL support\")\n\n        self.keyfile = ssl_keyfile\n        self.certfile = ssl_certfile\n        if ssl_cert_reqs is None:\n            ssl_cert_reqs = ssl.CERT_NONE\n        elif isinstance(ssl_cert_reqs, str):\n            CERT_REQS = {  # noqa: N806\n                \"none\": ssl.CERT_NONE,\n                \"optional\": ssl.CERT_OPTIONAL,\n                \"required\": ssl.CERT_REQUIRED,\n            }\n            if ssl_cert_reqs not in CERT_REQS:\n                raise RedisError(\n                    f\"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}\"\n                )\n            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]\n        self.cert_reqs = ssl_cert_reqs\n        self.ssl_include_verify_flags = ssl_include_verify_flags","sourceCodeStart":2100,"sourceCodeEnd":2136,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2100-L2136","documentation":"Raised by SSLConnection.__init__ (connection.py:2118) when the module-level flag SSL_AVAILABLE is False. SSL_AVAILABLE is set in redis/utils.py:30-35 based on whether `import ssl` succeeds at interpreter startup. This is a build-time property of the Python interpreter itself, not a missing redis-py dependency — it means the running Python was compiled/linked without OpenSSL.","triggerScenarios":"Instantiating SSLConnection directly, or constructing a client with a rediss:// URL (parse_url sets connection_class=SSLConnection at line 2384-2385), or passing ssl=True / connection_class=SSLConnection to Redis()/ConnectionPool(). The check `if not SSL_AVAILABLE` fires in __init__ before any network I/O.","commonSituations":"Using a custom-compiled or stripped Python (e.g. some slim Docker base images, pyenv builds missing libssl-dev, RHEL-derived images, or Python built from source without proper SSL linkage). Switching a working redis:// app to rediss:// against Redis Cloud / a TLS endpoint and hitting this on a minimal CI image.","solutions":["Reinstall or rebuild Python with SSL support: on Debian/Ubuntu `apt-get install libssl-dev` before compiling; on pyenv ensure build deps are present then `pyenv install <version>`.","Switch to an official CPython distribution or Docker base image that ships with SSL (e.g. python:3.x-slim instead of a hand-rolled scratch build).","Verify with `python -c \"import ssl; print(ssl.OPENSSL_VERSION)\"` — if it raises ImportError, the interpreter is the problem, not redis-py.","As a temporary workaround, drop TLS and use a plain redis:// connection only if the network path does not require encryption (not recommended for production)."],"exampleFix":"# before (fails on SSL-less interpreter)\nclient = redis.Redis.from_url(\"rediss://my-host:6379\")\n\n# after: rebuild python with ssl, verify, then the same call works\n# python -c \"import ssl; print(ssl.OPENSSL_VERSION)\"\nclient = redis.Redis.from_url(\"rediss://my-host:6379\")","handlingStrategy":"validation","validationCode":"import ssl\ntry:\n    import ssl  # noqa\n    SSL_OK = True\nexcept ImportError:\n    SSL_OK = False\n\nif not SSL_OK and url.startswith(\"rediss://\"):\n    raise RuntimeError(\"rediss:// requires a Python built with SSL support\")\n\nclient = redis.Redis.from_url(url) if SSL_OK else None","typeGuard":"def supports_ssl() -> bool:\n    try:\n        import ssl  # noqa: F401\n        return True\n    except ImportError:\n        return False","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    client = redis.Redis.from_url(\"rediss://host\")\n    client.ping()\nexcept RedisError as e:\n    if \"SSL support\" in str(e):\n        raise SystemExit(\"Rebuild Python with SSL or use redis://\")\n    raise","preventionTips":["Pin a Python distribution known to ship SSL in CI and prod images (official python:* images).","Add a startup self-check: `python -c \"import ssl\"` before launching the app.","Keep TLS off (redis://) in local/dev until the prod image is confirmed SSL-capable."],"tags":["ssl","build-environment","configuration","connection"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}