{"id":"a842d3fb2509205c","repo":"redis/redis-py","slug":"cryptography-is-not-installed","errorCode":null,"errorMessage":"cryptography is not installed.","messagePattern":"cryptography is not installed\\.","errorType":"exception","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2202,"sourceCode":"            context.load_cert_chain(\n                certfile=self.certfile,\n                keyfile=self.keyfile,\n                password=self.certificate_password,\n            )\n        if (\n            self.ca_certs is not None\n            or self.ca_path is not None\n            or self.ca_data is not None\n        ):\n            context.load_verify_locations(\n                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data\n            )\n        if self.ssl_min_version is not None:\n            context.minimum_version = self.ssl_min_version\n        if self.ssl_ciphers:\n            context.set_ciphers(self.ssl_ciphers)\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:\n            raise RedisError(\"cryptography is not installed.\")\n\n        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:\n            raise RedisError(\n                \"Either an OCSP staple or pure OCSP connection must be validated \"\n                \"- not both.\"\n            )\n\n        sslsock = context.wrap_socket(sock, server_hostname=self.host)\n\n        # validation for the stapled case\n        if self.ssl_validate_ocsp_stapled:\n            import OpenSSL\n\n            from .ocsp import ocsp_staple_verifier\n\n            # if a context is provided use it - otherwise, a basic context\n            if self.ssl_ocsp_context is None:\n                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)","sourceCodeStart":2184,"sourceCodeEnd":2220,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2184-L2220","documentation":"Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2201-2202) when ssl_validate_ocsp=True but CRYPTOGRAPHY_AVAILABLE is False. CRYPTOGRAPHY_AVAILABLE (utils.py:37-42) is True only if `import cryptography` succeeds. Pure (non-stapled) OCSP verification requires the cryptography library to parse and verify certificate/OCSP responses.","triggerScenarios":"Constructing a client with ssl_validate_ocsp=True (full/pure OCSP validation, not stapled) without having installed the cryptography package. Triggered during the first connection attempt inside _connect → _wrap_socket_with_ssl.","commonSituations":"Enabling OCSP validation for stricter TLS deployments (Redis Cloud, regulated environments) but forgetting the `ocsp` extra; minimal/production images where cryptography isn't bundled; upgrading security requirements without updating install requirements.","solutions":["Install cryptography: `pip install cryptography` (or `pip install redis[ocsp]` which pulls it in).","If you only need stapled OCSP, use ssl_validate_ocsp_stapled=True instead of ssl_validate_ocsp=True — the stapled path does not require cryptography (it uses pyOpenSSL).","Disable OCSP validation (set ssl_validate_ocsp=False / omit it) if it is not actually required by your deployment."],"exampleFix":"# before\nclient = redis.Redis.from_url(\"rediss://h\", ssl_validate_ocsp=True)\n# raises: cryptography is not installed.\n\n# after\n# pip install redis[ocsp]\nclient = redis.Redis.from_url(\"rediss://h\", ssl_validate_ocsp=True)","handlingStrategy":"validation","validationCode":"try:\n    import cryptography  # noqa\n    HAS_CRYPTO = True\nexcept ImportError:\n    HAS_CRYPTO = False\n\nif use_pure_ocsp and not HAS_CRYPTO:\n    raise RuntimeError(\"ssl_validate_ocsp=True requires the cryptography package; pip install redis[ocsp]\")\n\nclient = redis.Redis.from_url(url, ssl_validate_ocsp=use_pure_ocsp)","typeGuard":"def cryptography_available() -> bool:\n    try:\n        import cryptography  # noqa: F401\n        return True\n    except ImportError:\n        return False","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    client = redis.Redis.from_url(url, ssl_validate_ocsp=True)\n    client.ping()\nexcept RedisError as e:\n    if \"cryptography is not installed\" in str(e):\n        import subprocess; subprocess.check_call([\"pip\", \"install\", \"cryptography\"])\n        client = redis.Redis.from_url(url, ssl_validate_ocsp=True)\n    else:\n        raise","preventionTips":["Install redis[ocsp] in environments using OCSP validation.","Prefer stapled OCSP (ssl_validate_ocsp_stapled) to avoid the cryptography dependency where the server supports it.","Add a requirements check in CI that asserts cryptography is present when OCSP is configured."],"tags":["ssl","ocsp","dependency","configuration"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}