redis/redis-py · error · RedisError

Either an OCSP staple or pure OCSP connection must be…

Error message

Either an OCSP staple or pure OCSP connection must be validated - not both.

What it means

Raised in SSLConnection._wrap_socket_with_ssl when both ssl_validate_ocsp and ssl_validate_ocsp_stapled are True. The two OCSP modes are mutually exclusive: pure OCSP validates by contacting an OCSP responder (needs cryptography), while stapled OCSP validates a certificate-status response the server attaches to the handshake (uses pyOpenSSL). You must pick exactly one.

Solutions

1. Keep exactly one: ssl_validate_ocsp=True (pure, contacts responder) OR ssl_validate_ocsp_stapled=True (uses server-stapled response).
2. Set both to False if OCSP validation is not required.
3. Audit your SSL config builder to ensure the two flags are never toggled together.

Example fix

# before
r = redis.Redis(ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)
# after
r = redis.Redis(ssl_validate_ocsp_stapled=True)

if ssl_validate_ocsp and ssl_validate_ocsp_stapled:
    raise ValueError('Enable exactly one of ssl_validate_ocsp / ssl_validate_ocsp_stapled')
r = redis.Redis(ssl_validate_ocsp=ssl_validate_ocsp,
               ssl_validate_ocsp_stapled=ssl_validate_ocsp_stapled)

def ocsp_flags_consistent(pure: bool, stapled: bool) -> bool:
    return not (pure and stapled)

from redis.exceptions import RedisError
try:
    r = redis.Redis(ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)
except RedisError:
    # pick one mode
    r = redis.Redis(ssl_validate_ocsp_stapled=True)

When it happens

Trigger: Constructing a connection with both ssl_validate_ocsp=True and ssl_validate_ocsp_stapled=True. Copying two OCSP flags from documentation without realizing they conflict.

Common situations: Over-eager TLS hardening that enables every OCSP-related flag. Merging configs from multiple examples. Automation that turns on 'all' ssl validation knobs.

Related errors

• cryptography is not installed.
• No AIA information present in ssl certificate
• no ocsp response present
• no ocsp servers in certificate
• delegate not authorized for ocsp signing

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/a5d3ece93564ca4c. Report an issue: GitHub.

Appendix: source

Thrown at redis/connection.py:2221

                password=self.certificate_password,
            )
        if (
            self.ca_certs is not None
            or self.ca_path is not None
            or self.ca_data is not None
        ):
            context.load_verify_locations(
                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data
            )
        if self.ssl_min_version is not None:
            context.minimum_version = self.ssl_min_version
        if self.ssl_ciphers:
            context.set_ciphers(self.ssl_ciphers)
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:
            raise RedisError("cryptography is not installed.")

        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:
            raise RedisError(
                "Either an OCSP staple or pure OCSP connection must be validated "
                "- not both."
            )

        sslsock = context.wrap_socket(sock, server_hostname=self.host)

        # validation for the stapled case
        if self.ssl_validate_ocsp_stapled:
            import OpenSSL

            from .ocsp import ocsp_staple_verifier

            # if a context is provided use it - otherwise, a basic context
            if self.ssl_ocsp_context is None:
                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
                staple_ctx.use_certificate_file(self.certfile)
                staple_ctx.use_privatekey_file(self.keyfile)
            else:

View on GitHub (pinned to 6a6b581b48)