What causes "cryptography is not installed." in redis/redis-py?

Install cryptography: `pip install cryptography` (or `pip install redis[ocsp]` which pulls it in).

redis/redis-py · error · RedisError

cryptography is not installed.

Error message

cryptography is not installed.

What it means

Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2201-2202) when ssl_validate_ocsp=True but CRYPTOGRAPHY_AVAILABLE is False. CRYPTOGRAPHY_AVAILABLE (utils.py:37-42) is True only if `import cryptography` succeeds. Pure (non-stapled) OCSP verification requires the cryptography library to parse and verify certificate/OCSP responses.

Source

Thrown at redis/connection.py:2202

            context.load_cert_chain(
                certfile=self.certfile,
                keyfile=self.keyfile,
                password=self.certificate_password,
            )
        if (
            self.ca_certs is not None
            or self.ca_path is not None
            or self.ca_data is not None
        ):
            context.load_verify_locations(
                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data
            )
        if self.ssl_min_version is not None:
            context.minimum_version = self.ssl_min_version
        if self.ssl_ciphers:
            context.set_ciphers(self.ssl_ciphers)
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:
            raise RedisError("cryptography is not installed.")

        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:
            raise RedisError(
                "Either an OCSP staple or pure OCSP connection must be validated "
                "- not both."
            )

        sslsock = context.wrap_socket(sock, server_hostname=self.host)

        # validation for the stapled case
        if self.ssl_validate_ocsp_stapled:
            import OpenSSL

            from .ocsp import ocsp_staple_verifier

            # if a context is provided use it - otherwise, a basic context
            if self.ssl_ocsp_context is None:
                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)

View on GitHub (pinned to da03cdc7e8)

Solutions

Install cryptography: `pip install cryptography` (or `pip install redis[ocsp]` which pulls it in).
If you only need stapled OCSP, use ssl_validate_ocsp_stapled=True instead of ssl_validate_ocsp=True — the stapled path does not require cryptography (it uses pyOpenSSL).
Disable OCSP validation (set ssl_validate_ocsp=False / omit it) if it is not actually required by your deployment.

Example fix

# before
client = redis.Redis.from_url("rediss://h", ssl_validate_ocsp=True)
# raises: cryptography is not installed.

# after
# pip install redis[ocsp]
client = redis.Redis.from_url("rediss://h", ssl_validate_ocsp=True)

Defensive patterns

Strategy: validation

Validate before calling

try:
    import cryptography  # noqa
    HAS_CRYPTO = True
except ImportError:
    HAS_CRYPTO = False

if use_pure_ocsp and not HAS_CRYPTO:
    raise RuntimeError("ssl_validate_ocsp=True requires the cryptography package; pip install redis[ocsp]")

client = redis.Redis.from_url(url, ssl_validate_ocsp=use_pure_ocsp)

Type guard

def cryptography_available() -> bool:
    try:
        import cryptography  # noqa: F401
        return True
    except ImportError:
        return False

Try / catch

from redis.exceptions import RedisError
try:
    client = redis.Redis.from_url(url, ssl_validate_ocsp=True)
    client.ping()
except RedisError as e:
    if "cryptography is not installed" in str(e):
        import subprocess; subprocess.check_call(["pip", "install", "cryptography"])
        client = redis.Redis.from_url(url, ssl_validate_ocsp=True)
    else:
        raise

Prevention

Install redis[ocsp] in environments using OCSP validation.
Prefer stapled OCSP (ssl_validate_ocsp_stapled) to avoid the cryptography dependency where the server supports it.
Add a requirements check in CI that asserts cryptography is present when OCSP is configured.

When it happens

Trigger: Constructing a client with ssl_validate_ocsp=True (full/pure OCSP validation, not stapled) without having installed the cryptography package. Triggered during the first connection attempt inside _connect → _wrap_socket_with_ssl.

Common situations: Enabling OCSP validation for stricter TLS deployments (Redis Cloud, regulated environments) but forgetting the `ocsp` extra; minimal/production images where cryptography isn't bundled; upgrading security requirements without updating install requirements.

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/a842d3fb2509205c.json. Report an issue: GitHub.