What causes "failed to fetch ocsp certificate" in redis/redis-py?

Confirm the OCSP responder accepts the GET (base64-encoded) OCSP request form; if it requires POST, this path cannot work and you may need a different verification approach.

redis/redis-py · error · ConnectionError

failed to fetch ocsp certificate

Error message

failed to fetch ocsp certificate

What it means

Raised as a ConnectionError by OCSPVerifier.check_certificate (redis/ocsp.py:287) when requests.get(ocsp_url).ok is False — the HTTP GET to the OCSP responder returned a non-2xx status. This happens after the issuer cert was fetched successfully and the OCSP request URL was built; the responder itself rejected or errored on the request. Note the GET method used here is technically non-standard (RFC 6960 defines POST for full requests), which some responders reject.

Solutions

Confirm the OCSP responder accepts the GET (base64-encoded) OCSP request form; if it requires POST, this path cannot work and you may need a different verification approach.
Verify the responder URL and network reachability (curl the responder base URL).
Check for rate limiting (429) or maintenance status from the responder.
If the responder requires signed requests or specific headers, ensure they are configured (note the current implementation sends Host + Content-Type only).

Example fix

# before - responder returns non-2xx for the OCSP GET
verifier.is_valid()  # ConnectionError: failed to fetch ocsp certificate

# after - verify responder supports GET-based OCSP and is reachable
# curl -sSI 'http://ocsp.example.com/<base64-request>'  -> expect 200 application/ocsp-response
# if responder is POST-only, use an OCSP path that issues POST (e.g. ocsp_staple_verifier with server-side stapling)

Defensive patterns

Strategy: try-catch

Validate before calling

import requests

def ocsp_responder_accepts_get(ocsp_url, timeout=5):
    try:
        r = requests.get(ocsp_url, timeout=timeout)
        return r.ok
    except requests.RequestException:
        return False

Try / catch

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'failed to fetch ocsp certificate' in str(e):
        logging.warning('OCSP responder GET failed - responder may be POST-only or unreachable: %s', e)
    raise

Prevention

Confirm the OCSP responder accepts the GET (base64-encoded) OCSP request form redis-py uses.
Verify the responder URL is reachable and not rate-limiting (curl the responder base URL).
If the responder is POST-only, use OCSP stapling (server-side) so the client verifies a server-fetched response.
Watch for responder maintenance windows and 429 rate limiting.

When it happens

Trigger: OCSPVerifier.check_certificate builds the OCSP URL via build_certificate_url (base64-encodes the DER request and appends it to the responder URL), then requests.get(ocsp_url) returns non-OK. Responder returns 4xx/5xx, the responder rejects GET-based OCSP (expects POST), or the network path fails.

Common situations: OCSP responder that only accepts POST (RFC 6960 sec A.1.1) and returns 405/400 for the GET form redis-py uses; responder down or rate-limiting (429); responder requires authentication; firewall blocks the responder URL; URL malformed by base64 padding/encoding issues.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/612e6f63253b02cd. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:287

    def check_certificate(self, server, cert, issuer_url):
        """Checks the validity of an ocsp server for an issuer"""

        r = requests.get(issuer_url)
        if not r.ok:
            raise ConnectionError("failed to fetch issuer certificate")
        der = r.content
        issuer_cert = self._bin2ascii(der)

        ocsp_url = self.build_certificate_url(server, cert, issuer_cert)

        # HTTP 1.1 mandates the addition of the Host header in ocsp responses
        header = {
            "Host": urlparse(ocsp_url).netloc,
            "Content-Type": "application/ocsp-request",
        }
        r = requests.get(ocsp_url, headers=header)
        if not r.ok:
            raise ConnectionError("failed to fetch ocsp certificate")
        return _check_certificate(issuer_cert, r.content, True)

    def is_valid(self):
        """Returns the validity of the certificate wrapping our socket.
        This first retrieves for validate the certificate, issuer_url,
        and ocsp_server for certificate validate. Then retrieves the
        issuer certificate from the issuer_url, and finally checks
        the validity of OCSP revocation status.
        """

        # validate the certificate
        try:
            cert, issuer_url, ocsp_server = self.components_from_socket()
            if issuer_url is None:
                raise ConnectionError("no issuers found in certificate chain")
            return self.check_certificate(ocsp_server, cert, issuer_url)
        except AuthorizationError:
            cert, issuer_url, ocsp_server = self.components_from_direct_connection()

View on GitHub (pinned to 6a6b581b48)