What causes "cryptography is not installed." in redis/redis-py?

Install cryptography: pip install cryptography (or pip install redis[ocsp]).

redis/redis-py · error · RedisError

cryptography is not installed.

Error message

cryptography is not installed.

What it means

Raised in SSLConnection._wrap_socket_with_ssl when ssl_validate_ocsp is True but the optional cryptography package is not installed (CRYPTOGRAPHY_AVAILABLE is False). Pure (non-stapled) OCSP validation needs the cryptography library to parse and verify the OCSP response; without it the check cannot run. Install the ocsp extra or the cryptography package directly.

Solutions

Install cryptography: pip install cryptography (or pip install redis[ocsp]).
If you only have a stapled OCSP response to verify, use ssl_validate_ocsp_stapled=True instead, which uses pyOpenSSL rather than cryptography.
Disable OCSP validation (ssl_validate_ocsp=False) if it is not required by your security policy.

Example fix

# before - raises when connection opens
r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)
# after
pip install redis[ocsp]
r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)

Defensive patterns

Strategy: validation

Validate before calling

try:
    import cryptography  # noqa: F401
    crypto_ok = True
except ImportError:
    crypto_ok = False

if user_wants_ocsp and not crypto_ok:
    raise RuntimeError('ssl_validate_ocsp=True requires the cryptography package; pip install redis[ocsp]')

r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=user_wants_ocsp)

Type guard

def cryptography_available() -> bool:
    try:
        import cryptography  # noqa: F401
        return True
    except ImportError:
        return False

Try / catch

from redis.exceptions import RedisError
try:
    r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)
    r.ping()
except RedisError as e:
    if 'cryptography is not installed' in str(e):
        # fall back to stapled OCSP (pyOpenSSL) or disable pure OCSP
        r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp_stapled=True)
    else:
        raise

Prevention

Add redis[ocsp] (or cryptography) to requirements whenever you enable ssl_validate_ocsp.
Pin cryptography in CI images that run OCSP checks.
Use stapled OCSP if you cannot install cryptography.

When it happens

Trigger: Constructing a client with ssl_validate_ocsp=True on an environment that lacks the cryptography package. The error surfaces only when a real connection is opened (_wrap_socket_with_ssl), not at client construction.

Common situations: Enabling OCSP validation in production without adding the ocsp extra to requirements. Minimal CI images that exclude cryptography. Enabling ssl_validate_ocsp after a dependency cleanup.

Related errors

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/a842d3fb2509205c. Report an issue: GitHub.

Appendix: source

Thrown at redis/connection.py:2218

            context.load_cert_chain(
                certfile=self.certfile,
                keyfile=self.keyfile,
                password=self.certificate_password,
            )
        if (
            self.ca_certs is not None
            or self.ca_path is not None
            or self.ca_data is not None
        ):
            context.load_verify_locations(
                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data
            )
        if self.ssl_min_version is not None:
            context.minimum_version = self.ssl_min_version
        if self.ssl_ciphers:
            context.set_ciphers(self.ssl_ciphers)
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:
            raise RedisError("cryptography is not installed.")

        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:
            raise RedisError(
                "Either an OCSP staple or pure OCSP connection must be validated "
                "- not both."
            )

        sslsock = context.wrap_socket(sock, server_hostname=self.host)

        # validation for the stapled case
        if self.ssl_validate_ocsp_stapled:
            import OpenSSL

            from .ocsp import ocsp_staple_verifier

            # if a context is provided use it - otherwise, a basic context
            if self.ssl_ocsp_context is None:
                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)

View on GitHub (pinned to 6a6b581b48)