redis/redis-py · error · ConnectionError

failed to fetch issuer certificate

Error message

failed to fetch issuer certificate

What it means

Raised as a ConnectionError by OCSPVerifier.check_certificate (redis/ocsp.py:274) when requests.get(issuer_url).ok is False — the HTTP fetch of the issuer certificate (from the AIA CA Issuers URL) failed with a non-2xx status. The verifier needs the issuer cert to build the OCSP request and verify the response signature, so an issuer fetch failure aborts before OCSP can be queried.

Solutions

1. Verify the CA Issuers URL in the certificate's AIA resolves and serves the issuer cert (curl the URL).
2. Ensure the host running redis-py can reach the CA Issuers endpoint (firewall/proxy/DNS); configure requests to use the proxy if needed.
3. If the URL is stale, re-issue the cert with the corrected CA Issuers AIA entry.
4. As a workaround, supply the issuer cert out-of-band if your verification path allows it, but prefer fixing the published URL.

Example fix

# before - CA Issuers URL unreachable / 404
verifier.is_valid()  # ConnectionError: failed to fetch issuer certificate

# after - confirm/fetch the issuer cert URL and fix AIA if stale
# curl -sSI <issuer_url>  -> 200 OK with application/x-x509-ca-cert
# if stale, re-issue cert with correct caIssuers URI in AIA

import requests

def issuer_url_reachable(issuer_url, timeout=5):
    try:
        r = requests.get(issuer_url, timeout=timeout)
        return r.ok
    except requests.RequestException:
        return False

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'failed to fetch issuer certificate' in str(e):
        logging.warning('CA Issuers URL unreachable - check network/proxy and AIA URL: %s', e)
    raise

When it happens

Trigger: OCSPVerifier.is_valid()/check_certificate() fetches the CA Issuers URL extracted from AIA, and the HTTP server returns an error (404, 500, etc.) or is unreachable. requests.get is called without a timeout, so a hung server can also stall here before raising.

Common situations: CA Issuers URL is wrong or returns 404; the CA's issuer-cert hosting endpoint is down; network/firewall blocks the HTTP fetch; corporate proxy required but not configured for requests; URL uses a cert the client rejects; the issuer cert was relocated and AIA points to the old location.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to fetch ocsp certificate
• delegate not authorized for ocsp signing
• failed to retrieve a successful response from the ocsp…
• failed to valid ocsp response
• No AIA information present in ssl certificate

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/154f3bad6b604c01. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:274

        # add_certificate returns an initialized OCSPRequestBuilder
        orb = orb.add_certificate(
            cert, issuer_cert, cryptography.hazmat.primitives.hashes.SHA256()
        )
        request = orb.build()

        path = base64.b64encode(
            request.public_bytes(hazmat.primitives.serialization.Encoding.DER)
        )
        url = urljoin(server, path.decode("ascii"))
        return url

    def check_certificate(self, server, cert, issuer_url):
        """Checks the validity of an ocsp server for an issuer"""

        r = requests.get(issuer_url)
        if not r.ok:
            raise ConnectionError("failed to fetch issuer certificate")
        der = r.content
        issuer_cert = self._bin2ascii(der)

        ocsp_url = self.build_certificate_url(server, cert, issuer_cert)

        # HTTP 1.1 mandates the addition of the Host header in ocsp responses
        header = {
            "Host": urlparse(ocsp_url).netloc,
            "Content-Type": "application/ocsp-request",
        }
        r = requests.get(ocsp_url, headers=header)
        if not r.ok:
            raise ConnectionError("failed to fetch ocsp certificate")
        return _check_certificate(issuer_cert, r.content, True)

    def is_valid(self):
        """Returns the validity of the certificate wrapping our socket.
        This first retrieves for validate the certificate, issuer_url,

View on GitHub (pinned to 6a6b581b48)