{"id":"aae86099ee6a86b6","repo":"redis/redis-py","slug":"invalid-ssl-certificate-requirements-flag-ssl-ce","errorCode":null,"errorMessage":"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}","messagePattern":"Invalid SSL Certificate Requirements Flag: (.+?)","errorType":"validation","errorClass":"RedisError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2131,"sourceCode":"\n        Raises:\n            RedisError\n        \"\"\"  # noqa\n        if not SSL_AVAILABLE:\n            raise RedisError(\"Python wasn't built with SSL support\")\n\n        self.keyfile = ssl_keyfile\n        self.certfile = ssl_certfile\n        if ssl_cert_reqs is None:\n            ssl_cert_reqs = ssl.CERT_NONE\n        elif isinstance(ssl_cert_reqs, str):\n            CERT_REQS = {  # noqa: N806\n                \"none\": ssl.CERT_NONE,\n                \"optional\": ssl.CERT_OPTIONAL,\n                \"required\": ssl.CERT_REQUIRED,\n            }\n            if ssl_cert_reqs not in CERT_REQS:\n                raise RedisError(\n                    f\"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}\"\n                )\n            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]\n        self.cert_reqs = ssl_cert_reqs\n        self.ssl_include_verify_flags = ssl_include_verify_flags\n        self.ssl_exclude_verify_flags = ssl_exclude_verify_flags\n        self.ca_certs = ssl_ca_certs\n        self.ca_data = ssl_ca_data\n        self.ca_path = ssl_ca_path\n        self.check_hostname = (\n            ssl_check_hostname if self.cert_reqs != ssl.CERT_NONE else False\n        )\n        self.certificate_password = ssl_password\n        self.ssl_validate_ocsp = ssl_validate_ocsp\n        self.ssl_validate_ocsp_stapled = ssl_validate_ocsp_stapled\n        self.ssl_ocsp_context = ssl_ocsp_context\n        self.ssl_ocsp_expected_cert = ssl_ocsp_expected_cert\n        self.ssl_min_version = ssl_min_version","sourceCodeStart":2113,"sourceCodeEnd":2149,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2113-L2149","documentation":"Raised by SSLConnection.__init__ (connection.py:2130-2133) when ssl_cert_reqs is passed as a string that is not one of the recognized keys: \"none\", \"optional\", or \"required\" (mapped at lines 2125-2129 to ssl.CERT_NONE / CERT_OPTIONAL / CERT_REQUIRED). Numeric/enum values bypass this check; only invalid string spellings trip it.","triggerScenarios":"Passing ssl_cert_reqs=\"require\", \"CERT_REQUIRED\", \"yes\", or any typo as a string to SSLConnection or via a client/ConnectionPool. Note: the default is the string \"required\" (line 2076), which IS valid — only other strings raise.","commonSituations":"Copying config from code that uses the ssl module constants directly (ssl.CERT_REQUIRED is an int, valid) into a string form with the wrong spelling; passing the enum name \"CERT_REQUIRED\" instead of the redis alias \"required\"; config files / env vars feeding an unrecognized value.","solutions":["Use one of the three accepted string aliases: \"none\", \"optional\", or \"required\".","Pass the ssl module constant instead of a string (ssl.CERT_NONE / ssl.CERT_OPTIONAL / ssl.CERT_REQUIRED), which are ints and skip the string-validation branch.","If the value comes from config/env, validate it against {\"none\",\"optional\",\"required\"} before constructing the client."],"exampleFix":"# before\nclient = redis.Redis.from_url(\"rediss://h\", ssl_cert_reqs=\"require\")\n\n# after\nclient = redis.Redis.from_url(\"rediss://h\", ssl_cert_reqs=\"required\")\n# or\nimport ssl\nclient = redis.Redis.from_url(\"rediss://h\", ssl_cert_reqs=ssl.CERT_REQUIRED)","handlingStrategy":"validation","validationCode":"import ssl\nVALID_CERT_REQS = {\"none\", \"optional\", \"required\"}\n\ndef normalize_cert_reqs(v):\n    if isinstance(v, str):\n        assert v in VALID_CERT_REQS, f\"ssl_cert_reqs must be one of {VALID_CERT_REQS}\"\n    return v\n\nclient = redis.Redis.from_url(\"rediss://h\", ssl_cert_reqs=normalize_cert_reqs(my_val))","typeGuard":"from typing import Union\nimport ssl\n\ndef is_valid_cert_reqs(v) -> bool:\n    if isinstance(v, int) and v in (ssl.CERT_NONE, ssl.CERT_OPTIONAL, ssl.CERT_REQUIRED):\n        return True\n    return v in (\"none\", \"optional\", \"required\")","tryCatchPattern":"from redis.exceptions import RedisError\ntry:\n    client = redis.Redis(ssl_cert_reqs=req)\nexcept RedisError as e:\n    if \"Invalid SSL Certificate Requirements\" in str(e):\n        req = \"required\"\n        client = redis.Redis(ssl_cert_reqs=req)\n    else:\n        raise","preventionTips":["Standardize on the ssl module constants (ssl.CERT_REQUIRED) in config rather than strings.","Validate config-sourced strings against {none,optional,required} before constructing the client.","Document the three accepted aliases where TLS config lives."],"tags":["ssl","configuration","validation","connection"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}