{"id":"dc752fd46692768e","repo":"redis/redis-py","slug":"invalid-ssl-verify-flag-flag","errorCode":null,"errorMessage":"Invalid ssl verify flag: {flag}","messagePattern":"Invalid ssl verify flag: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"redis/asyncio/connection.py","lineNumber":1732,"sourceCode":"\ndef to_bool(value) -> Optional[bool]:\n    if value is None or value == \"\":\n        return None\n    if isinstance(value, str) and value.upper() in FALSE_STRINGS:\n        return False\n    return bool(value)\n\n\ndef parse_ssl_verify_flags(value):\n    # flags are passed in as a string representation of a list,\n    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN\n    verify_flags_str = value.replace(\"[\", \"\").replace(\"]\", \"\")\n\n    verify_flags = []\n    for flag in verify_flags_str.split(\",\"):\n        flag = flag.strip()\n        if not hasattr(VerifyFlags, flag):\n            raise ValueError(f\"Invalid ssl verify flag: {flag}\")\n        verify_flags.append(getattr(VerifyFlags, flag))\n    return verify_flags\n\n\nURL_QUERY_ARGUMENT_PARSERS: Mapping[str, Callable[..., object]] = MappingProxyType(\n    {\n        \"db\": int,\n        \"socket_timeout\": float,\n        \"socket_connect_timeout\": float,\n        \"socket_read_size\": int,\n        \"socket_keepalive\": to_bool,\n        \"retry_on_timeout\": to_bool,\n        \"max_connections\": int,\n        \"health_check_interval\": int,\n        \"ssl_check_hostname\": to_bool,\n        \"ssl_include_verify_flags\": parse_ssl_verify_flags,\n        \"ssl_exclude_verify_flags\": parse_ssl_verify_flags,\n        \"ssl_min_version\": int,","sourceCodeStart":1714,"sourceCodeEnd":1750,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/asyncio/connection.py#L1714-L1750","documentation":"Raised as a ValueError from parse_ssl_verify_flags() when a comma-separated verify-flag string contains a name that is not an attribute of ssl.VerifyFlags (e.g. 'VERIFY_X509_STRICT'). This parser is invoked for the ssl_include_verify_flags / ssl_exclude_verify_flags URL query params, which are passed as a stringified list.","triggerScenarios":"Using rediss://host?ssl_include_verify_flags=FOO or ?ssl_exclude_verify_flags=VERIFY_X509_TRUSTED_LAST where FOO/that-name is not a member of ssl.VerifyFlags on the running Python. The function strips brackets, splits on commas, and checks hasattr(VerifyFlags, flag).","commonSituations":"Typing a flag name wrong (VERIFY_X509_STRICT vs VERIFY_X509_STRICT-ish); flags that exist only on newer Python/OpenSSL (e.g. VERIFY_X509_PARTIAL_CHAIN on older builds); passing the ssl constant's int value as a string instead of its name; case mismatch (names are uppercase).","solutions":["Confirm the flag exists on your Python: 'ssl.VerifyFlags.__members__'.","Use the exact uppercase constant name (e.g. VERIFY_X509_STRICT).","Pass ssl.VerifyFlags constants directly via the Redis(...) kwargs instead of the URL string form.","Upgrade Python/OpenSSL if the flag is genuinely missing."],"exampleFix":"// before\nr = redis.asyncio.from_url(\"rediss://host?ssl_include_verify_flags=VERIFY_X509_STRICT,FOO\")\n\n// after\nimport ssl\nr = redis.asyncio.Redis(host=h, port=p, ssl=True, ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_STRICT])","handlingStrategy":"validation","validationCode":"import ssl\ndef validate_verify_flag_names(names: list[str]) -> list[str]:\n    valid = set(ssl.VerifyFlags.__members__)\n    bad = [n for n in names if n not in valid]\n    if bad:\n        raise ValueError(f\"Unknown VerifyFlags: {bad}; valid={sorted(valid)}\")\n    return names","typeGuard":"def is_known_verify_flag(name: str) -> bool:\n    import ssl\n    return hasattr(ssl.VerifyFlags, name)","tryCatchPattern":"try:\n    r = redis.asyncio.from_url(url)\nexcept ValueError as e:\n    if \"Invalid ssl verify flag\" in str(e):\n        # remove the offending query param or pass constants directly\n        r = redis.asyncio.Redis(host=h, port=p, ssl=True)\n    else:\n        raise","preventionTips":["Pass ssl.VerifyFlags constants directly instead of URL string names.","Cross-check names against ssl.VerifyFlags.__members__ on your Python.","Avoid specifying flags that only exist on newer OpenSSL."],"tags":["ssl","config","validation","url-parsing","tls","async"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}