{"id":"f4a11ba972cf29be","repo":"redis/redis-py","slug":"ocsp-validation-error","errorCode":null,"errorMessage":"ocsp validation error","messagePattern":"ocsp validation error","errorType":"exception","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2246,"sourceCode":"            )\n\n            #  need another socket\n            con = OpenSSL.SSL.Connection(staple_ctx, socket.socket())\n            con.request_ocsp()\n            con.connect((self.host, self.port))\n            con.do_handshake()\n            con.shutdown()\n            return sslsock\n\n        # pure ocsp validation\n        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE:\n            from .ocsp import OCSPVerifier\n\n            o = OCSPVerifier(sslsock, self.host, self.port, self.ca_certs)\n            if o.is_valid():\n                return sslsock\n            else:\n                raise ConnectionError(\"ocsp validation error\")\n        return sslsock\n\n\nclass UnixDomainSocketConnection(AbstractConnection):\n    \"Manages UDS communication to and from a Redis server\"\n\n    def __init__(self, path=\"\", socket_timeout=DEFAULT_SOCKET_TIMEOUT, **kwargs):\n        super().__init__(**kwargs)\n        self.path = path\n        self.socket_timeout = socket_timeout\n\n    def repr_pieces(self):\n        pieces = [(\"path\", self.path), (\"db\", self.db)]\n        if self.client_name:\n            pieces.append((\"client_name\", self.client_name))\n        return pieces\n\n    def _connect(self):","sourceCodeStart":2228,"sourceCodeEnd":2264,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2228-L2264","documentation":"Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2246) as a ConnectionError when pure OCSP validation is enabled (ssl_validate_ocsp=True, cryptography available) and OCSPVerifier.is_valid() returns False. This means the OCSP responder reported the server certificate as revoked, expired, or otherwise invalid, or the OCSP response itself failed to verify.","triggerScenarios":"First connection to a rediss:// host with ssl_validate_ocsp=True where the server cert is genuinely revoked/suspended, the OCSP responder is serving a bad signature, the chain cannot be built, or the OCSP response is stale. OCSPVerifier.is_valid() returning False produces this.","commonSituations":"Server certificate rotated/revoked by ops; intermediate CA change breaking OCSP chain validation; clock skew on the client causing 'not yet valid'/'expired' OCSP verdicts; misconfigured OCSP responder; transient responder outage returning a malformed response.","solutions":["Inspect the actual certificate and OCSP responder status directly: `openssl ocsp -issuer chain.pem -cert server.pem -url <ocsp-url> -resp_text` to see the real revocation/validity reason.","Verify the client clock is correct (NTP sync) — OCSP validity windows are time-sensitive.","Confirm the CA bundle used (ssl_ca_certs / system trust) matches the issuer chain of the server cert.","If the cert is legitimately revoked, rotate/reissue the server certificate; do not simply disable OCSP checks in production.","Temporarily set ssl_validate_ocsp=False only for diagnosis if you have independent confirmation the responder is at fault."],"exampleFix":"# before\nclient = redis.Redis.from_url(\"rediss://h\", ssl_validate_ocsp=True)\nclient.get(\"k\")  # raises ConnectionError: ocsp validation error\n\n# diagnose first\n# openssl ocsp -issuer chain.pem -cert server.pem -url \"$OCSP_URL\" -resp_text\n\n# after (cert reissued by ops, same config now succeeds)\nclient = redis.Redis.from_url(\"rediss://h\", ssl_validate_ocsp=True)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from redis.exceptions import ConnectionError\nfrom redis.backoff import ExponentialBackoff\nfrom redis.retry import Retry\n\nretry = Retry(ExponentialBackoff(), 3)\nattempts = 0\nwhile True:\n    try:\n        client = redis.Redis.from_url(url, ssl_validate_ocsp=True, retry=retry)\n        client.ping()\n        break\n    except ConnectionError as e:\n        if \"ocsp validation error\" in str(e):\n            attempts += 1\n            if attempts > 3:\n                raise  # genuine revocation/responder problem — surface it\n            continue\n        raise","preventionTips":["Monitor certificate expiry and OCSP responder health independently of the client.","Keep client clocks NTP-synced to avoid false OCSP failures.","Treat persistent OCSP errors as a security signal (possible revocation) before disabling checks.","Validate the CA bundle matches the server's issuer chain."],"tags":["ssl","ocsp","security","connection"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}