redis/redis-py · error · ConnectionError

delegate not authorized for ocsp signing

Error message

delegate not authorized for ocsp signing

What it means

Raised as a ConnectionError by _check_certificate (redis/ocsp.py:101) when a delegated responder certificate was found but it lacks the ExtendedKeyUsage extension containing the OCSP_SIGNING OID (x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING). RFC 6960 requires a delegated OCSP responder to hold this EKU to sign responses on behalf of the CA; its absence means the responder is not authorized to assert revocation status.

Solutions

1. Have the CA re-issue the delegated responder certificate with the OCSP_SIGNING ExtendedKeyUsage OID.
2. Confirm the correct responder cert is being selected (see error 470) so a non-OCSP cert isn't mistakenly tested for the EKU.
3. If the responder should sign directly with the CA key (authorized responder), configure it so responder identity matches the issuer and the delegation path is not taken.
4. Validate responder cert issuance against your PKI policy for OCSP delegation.

Example fix

# before - responder cert lacks OCSP_SIGNING EKU
_check_certificate(...)  # ConnectionError: delegate not authorized for ocsp signing

# after - re-issue responder cert with the OCSP signing EKU
# openssl: add extendedKeyUsage = OCSPSigning to the responder cert profile, re-issue, redeploy

from cryptography import x509
from cryptography.x509.oid import ExtendedKeyUsageOID

def cert_authorized_for_ocsp_signing(cert):
    try:
        ext = cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
        return ext is not None and ExtendedKeyUsageOID.OCSP_SIGNING in ext.value
    except x509.ExtensionNotFound:
        return False

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    _check_certificate(issuer_cert, ocsp_bytes)
except RedisConnectionError as e:
    if 'delegate not authorized for ocsp signing' in str(e):
        logging.warning('Responder cert missing OCSP_SIGNING EKU - re-issue with the EKU')
    raise

When it happens

Trigger: OCSP verification with a delegated responder whose certificate does not include ExtendedKeyUsage with OCSP_SIGNING. The code loads responder_certs[0], calls get_extension_for_class(x509.ExtendedKeyUsage), and if absent or missing the OCSP_SIGNING OID, raises.

Common situations: Responder cert issued by the CA but without the OCSP signing EKU (misissued); a cert was repurposed for OCSP signing without the proper EKU; CA tooling misconfiguration during responder cert renewal; the 'responder cert' selected is actually an unrelated cert that matched the name/hash by coincidence.

Related errors

• no certificates found for the responder
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…
• failed to fetch issuer certificate
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/3e6b04b450a61eb5. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:101

        responder_name is not None
        and responder_name == issuer_cert.subject
        or responder_hash == issuer_hash
    ):
        cert_to_validate = issuer_cert
    else:
        certs = ocsp_response.certificates
        responder_certs = _get_certificates(
            certs, issuer_cert, responder_name, responder_hash
        )

        try:
            responder_cert = responder_certs[0]
        except IndexError:
            raise ConnectionError("no certificates found for the responder")

        ext = responder_cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
        if ext is None or x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING not in ext.value:
            raise ConnectionError("delegate not authorized for ocsp signing")
        cert_to_validate = responder_cert

    if validate:
        _verify_response(cert_to_validate, ocsp_response)
    return True


def _get_certificates(certs, issuer_cert, responder_name, responder_hash):
    if responder_name is None:
        certificates = [
            c
            for c in certs
            if _get_pubkey_hash(c) == responder_hash and c.issuer == issuer_cert.subject
        ]
    else:
        certificates = [
            c
            for c in certs

View on GitHub (pinned to 6a6b581b48)