{"id":"a5d3ece93564ca4c","repo":"redis/redis-py","slug":"either-an-ocsp-staple-or-pure-ocsp-connection-must","errorCode":null,"errorMessage":"Either an OCSP staple or pure OCSP connection must be validated - not both.","messagePattern":"Either an OCSP staple or pure OCSP connection must be validated - not both\\.","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2205,"sourceCode":"                password=self.certificate_password,\n            )\n        if (\n            self.ca_certs is not None\n            or self.ca_path is not None\n            or self.ca_data is not None\n        ):\n            context.load_verify_locations(\n                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data\n            )\n        if self.ssl_min_version is not None:\n            context.minimum_version = self.ssl_min_version\n        if self.ssl_ciphers:\n            context.set_ciphers(self.ssl_ciphers)\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:\n            raise RedisError(\"cryptography is not installed.\")\n\n        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:\n            raise RedisError(\n                \"Either an OCSP staple or pure OCSP connection must be validated \"\n                \"- not both.\"\n            )\n\n        sslsock = context.wrap_socket(sock, server_hostname=self.host)\n\n        # validation for the stapled case\n        if self.ssl_validate_ocsp_stapled:\n            import OpenSSL\n\n            from .ocsp import ocsp_staple_verifier\n\n            # if a context is provided use it - otherwise, a basic context\n            if self.ssl_ocsp_context is None:\n                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)\n                staple_ctx.use_certificate_file(self.certfile)\n                staple_ctx.use_privatekey_file(self.keyfile)\n            else:","sourceCodeStart":2187,"sourceCodeEnd":2223,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2187-L2223","documentation":"Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2204-2208) when both ssl_validate_ocsp_stapled and ssl_validate_ocsp are True. These are mutually exclusive validation modes: stapled validates an OCSP response stapled by the server during the TLS handshake, while pure OCSP actively fetches and validates a response from an OCSP responder. The library refuses to run both on the same connection.","triggerScenarios":"Passing both ssl_validate_ocsp_stapled=True and ssl_validate_ocsp=True to SSLConnection / a rediss:// client. Fires at connection-wrap time on the first connect.","commonSituations":"Copy-pasting security config and enabling every OCSP flag 'to be safe'; merging two config snippets where one used stapled and the other used pure validation; misunderstanding the two OCSP modes as additive rather than alternative.","solutions":["Choose exactly one OCSP mode: keep ssl_validate_ocsp_stapled=True (server-stapled, uses pyOpenSSL) OR ssl_validate_ocsp=True (pure, uses cryptography), not both.","Prefer stapled (ssl_validate_ocsp_stapled) when your Redis server supports OCSP stapling — it is cheaper and does not require outbound calls to an OCSP responder.","Remove whichever flag your deployment does not actually use and re-test the connection."],"exampleFix":"# before (both set -> raises)\nclient = redis.Redis.from_url(\"rediss://h\",\n    ssl_validate_ocsp=True,\n    ssl_validate_ocsp_stapled=True)\n\n# after (pick one)\nclient = redis.Redis.from_url(\"rediss://h\",\n    ssl_validate_ocsp_stapled=True)","handlingStrategy":"validation","validationCode":"if ssl_validate_ocsp and ssl_validate_ocsp_stapled:\n    raise ValueError(\"Enable only one OCSP mode: stapled OR pure, not both.\")\n\nclient = redis.Redis.from_url(url,\n    ssl_validate_ocsp=ssl_validate_ocsp,\n    ssl_validate_ocsp_stapled=ssl_validate_ocsp_stapled)","typeGuard":"def ocsp_modes_mutually_exclusive(stapled: bool, pure: bool) -> bool:\n    return not (stapled and pure)","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    client = redis.Redis.from_url(url, ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)\nexcept RedisError as e:\n    if \"not both\" in str(e):\n        client = redis.Redis.from_url(url, ssl_validate_ocsp_stapled=True)\n    else:\n        raise","preventionTips":["Treat the two OCSP flags as a radio-button choice in config templates.","Default to stapled and only enable pure OCSP when the server lacks stapling.","Add a config lint rule rejecting both flags being true."],"tags":["ssl","ocsp","configuration","validation"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}