What causes "failed to fetch ocsp certificate" in redis/redis-py?

Disable OCSP validation if your deployment does not require it: drop the ssl_ocsp_context argument and connect with ssl=True only.

redis/redis-py · error · ConnectionError

failed to fetch ocsp certificate

Error message

failed to fetch ocsp certificate

What it means

Raised by OCSPValidator.check_certificate (redis/ocsp.py:287) during TLS connection setup when OCSP revocation checking is enabled. After building the OCSP request URL from the server certificate's AIA extension, the library performs requests.get(ocsp_url); if the OCSP responder returns a non-2xx HTTP status (r.ok is False), it raises redis.exceptions.ConnectionError. The library performs this check to refuse TLS connections whose revocation status cannot be verified.

Source

Thrown at redis/ocsp.py:287

    def check_certificate(self, server, cert, issuer_url):
        """Checks the validity of an ocsp server for an issuer"""

        r = requests.get(issuer_url)
        if not r.ok:
            raise ConnectionError("failed to fetch issuer certificate")
        der = r.content
        issuer_cert = self._bin2ascii(der)

        ocsp_url = self.build_certificate_url(server, cert, issuer_cert)

        # HTTP 1.1 mandates the addition of the Host header in ocsp responses
        header = {
            "Host": urlparse(ocsp_url).netloc,
            "Content-Type": "application/ocsp-request",
        }
        r = requests.get(ocsp_url, headers=header)
        if not r.ok:
            raise ConnectionError("failed to fetch ocsp certificate")
        return _check_certificate(issuer_cert, r.content, True)

    def is_valid(self):
        """Returns the validity of the certificate wrapping our socket.
        This first retrieves for validate the certificate, issuer_url,
        and ocsp_server for certificate validate. Then retrieves the
        issuer certificate from the issuer_url, and finally checks
        the validity of OCSP revocation status.
        """

        # validate the certificate
        try:
            cert, issuer_url, ocsp_server = self.components_from_socket()
            if issuer_url is None:
                raise ConnectionError("no issuers found in certificate chain")
            return self.check_certificate(ocsp_server, cert, issuer_url)
        except AuthorizationError:
            cert, issuer_url, ocsp_server = self.components_from_direct_connection()

View on GitHub (pinned to da03cdc7e8)

Solutions

Disable OCSP validation if your deployment does not require it: drop the ssl_ocsp_context argument and connect with ssl=True only.
Verify network egress to the OCSP responder URL extracted from the cert (inspect the AIA extension) and allow it through firewall/proxy.
Configure an HTTPS_PROXY/HTTP_PROXY environment variable so 'requests' can reach the OCSP responder through your corporate proxy.
Use a server certificate whose AIA extension points to a healthy, reachable OCSP responder.

Example fix

# before
client = redis.Redis(host='rediss.example.com', port=6379, ssl=True, ssl_ocsp_context=ocsp_ctx)
# after (drop OCSP validation if not required)
client = redis.Redis(host='rediss.example.com', port=6379, ssl=True)

Defensive patterns

Strategy: try-catch

Validate before calling

# Pre-flight: ensure the OCSP responder URL extracted from the cert is reachable
import requests
from cryptography import x509
from cryptography.hazmat.backends import default_backend

def ocsp_responder_reachable(cert_pem: bytes) -> bool:
    cert = x509.load_pem_x509_certificate(cert_pem, default_backend())
    try:
        aia = cert.extensions.get_extension_for_oid(
            x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS
        ).value
    except x509.extensions.ExtensionNotFound:
        return False
    ocsp_urls = [d.access_location.value for d in aia
                 if d.access_method == x509.oid.AuthorityInformationAccessOID.OCSP]
    if not ocsp_urls:
        return False
    try:
        return requests.get(ocsp_urls[0], timeout=5).ok
    except Exception:
        return False

Try / catch

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    client = redis.Redis(host=HOST, port=PORT, ssl=True, ssl_ocsp_context=ctx)
    client.ping()
except RedisConnectionError as e:
    if 'failed to fetch ocsp certificate' in str(e):
        # OCSP responder unreachable: fall back to TLS without OCSP validation
        client = redis.Redis(host=HOST, port=PORT, ssl=True)
    else:
        raise

Prevention

Only enable ssl_ocsp_context when your deployment mandates revocation checking and the responder is reachable.
Allowlist the OCSP responder host in your egress firewall/proxy.
Monitor OCSP responder uptime independently so you detect outages before clients fail.
Test the full TLS+OCSP path in staging with the production certificate.

When it happens

Trigger: Connecting with redis.Redis(..., ssl=True, ssl_ocsp_context=...) or RedisCluster with OCSP validation enabled, where the OCSP responder URL (extracted from the cert's Authority Information Access extension) returns an HTTP error (4xx/5xx), is unreachable, or is blocked. Specifically triggered when requests.get(ocsp_url, headers=header).ok evaluates False inside OCSPValidator.check_certificate.

Common situations: Corporate firewall / egress proxy blocking the OCSP responder host; OCSP responder temporarily down or misconfigured; self-signed or internal CA certs that point to a non-functional OCSP URL; air-gapped environments with no outbound HTTP; expired OCSP responder certificate causing TLS failure at the requests layer (which yields a non-ok response or exception).

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/612e6f63253b02cd.json. Report an issue: GitHub.