redis/redis-py · error · RedisError

Either an OCSP staple or pure OCSP connection must be valida

Error message

Either an OCSP staple or pure OCSP connection must be validated - not both.

What it means

Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2204-2208) when both ssl_validate_ocsp_stapled and ssl_validate_ocsp are True. These are mutually exclusive validation modes: stapled validates an OCSP response stapled by the server during the TLS handshake, while pure OCSP actively fetches and validates a response from an OCSP responder. The library refuses to run both on the same connection.

Source

Thrown at redis/connection.py:2205

                password=self.certificate_password,
            )
        if (
            self.ca_certs is not None
            or self.ca_path is not None
            or self.ca_data is not None
        ):
            context.load_verify_locations(
                cafile=self.ca_certs, capath=self.ca_path, cadata=self.ca_data
            )
        if self.ssl_min_version is not None:
            context.minimum_version = self.ssl_min_version
        if self.ssl_ciphers:
            context.set_ciphers(self.ssl_ciphers)
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE is False:
            raise RedisError("cryptography is not installed.")

        if self.ssl_validate_ocsp_stapled and self.ssl_validate_ocsp:
            raise RedisError(
                "Either an OCSP staple or pure OCSP connection must be validated "
                "- not both."
            )

        sslsock = context.wrap_socket(sock, server_hostname=self.host)

        # validation for the stapled case
        if self.ssl_validate_ocsp_stapled:
            import OpenSSL

            from .ocsp import ocsp_staple_verifier

            # if a context is provided use it - otherwise, a basic context
            if self.ssl_ocsp_context is None:
                staple_ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
                staple_ctx.use_certificate_file(self.certfile)
                staple_ctx.use_privatekey_file(self.keyfile)
            else:

View on GitHub (pinned to da03cdc7e8)

Solutions

Choose exactly one OCSP mode: keep ssl_validate_ocsp_stapled=True (server-stapled, uses pyOpenSSL) OR ssl_validate_ocsp=True (pure, uses cryptography), not both.
Prefer stapled (ssl_validate_ocsp_stapled) when your Redis server supports OCSP stapling — it is cheaper and does not require outbound calls to an OCSP responder.
Remove whichever flag your deployment does not actually use and re-test the connection.

Example fix

# before (both set -> raises)
client = redis.Redis.from_url("rediss://h",
    ssl_validate_ocsp=True,
    ssl_validate_ocsp_stapled=True)

# after (pick one)
client = redis.Redis.from_url("rediss://h",
    ssl_validate_ocsp_stapled=True)

Defensive patterns

Strategy: validation

Validate before calling

if ssl_validate_ocsp and ssl_validate_ocsp_stapled:
    raise ValueError("Enable only one OCSP mode: stapled OR pure, not both.")

client = redis.Redis.from_url(url,
    ssl_validate_ocsp=ssl_validate_ocsp,
    ssl_validate_ocsp_stapled=ssl_validate_ocsp_stapled)

Type guard

def ocsp_modes_mutually_exclusive(stapled: bool, pure: bool) -> bool:
    return not (stapled and pure)

Try / catch

from redis.exceptions import RedisError
try:
    client = redis.Redis.from_url(url, ssl_validate_ocsp=True, ssl_validate_ocsp_stapled=True)
except RedisError as e:
    if "not both" in str(e):
        client = redis.Redis.from_url(url, ssl_validate_ocsp_stapled=True)
    else:
        raise

Prevention

Treat the two OCSP flags as a radio-button choice in config templates.
Default to stapled and only enable pure OCSP when the server lacks stapling.
Add a config lint rule rejecting both flags being true.

When it happens

Trigger: Passing both ssl_validate_ocsp_stapled=True and ssl_validate_ocsp=True to SSLConnection / a rediss:// client. Fires at connection-wrap time on the first connect.

Common situations: Copy-pasting security config and enabling every OCSP flag 'to be safe'; merging two config snippets where one used stapled and the other used pure validation; misunderstanding the two OCSP modes as additive rather than alternative.

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/a5d3ece93564ca4c.json. Report an issue: GitHub.