redis/redis-py · error · ConnectionError

failed to retrieve a successful response from the ocsp…

Error message

failed to retrieve a successful response from the ocsp responder

What it means

Raised as a ConnectionError by _check_certificate (redis/ocsp.py:64) in the else branch — the response_status is neither UNAUTHORIZED nor SUCCESSFUL. Per RFC 6960 these are statuses like MALFORMED_REQUEST, INTERNAL_ERROR, TRY_LATER, SIG_REQUIRED, or UNAUTHORIZED. The responder processed the request but could not return a valid status, so the certificate's revocation state is undetermined and the connection is blocked.

Solutions

1. Retry the OCSP check — TRY_LATER is explicitly a transient status and a retry often succeeds once the responder recovers.
2. If SIG_REQUIRED, configure the OCSP request to be signed per the responder's policy (the current redis-py OCSP path does not sign requests, so this indicates a responder policy mismatch).
3. Inspect the raw response_status via ocsp.load_der_ocsp_response to identify the specific non-success code and act accordingly.
4. Confirm the OCSP request payload is well-formed for the responder (correct hash algorithm, supported issuer) to avoid MALFORMED_REQUEST.

Example fix

# before - single OCSP attempt fails on TRY_LATER / INTERNAL_ERROR
verifier.is_valid()  # ConnectionError: failed to retrieve a successful response

# after - retry transient responder failures with backoff
for attempt in range(3):
    try:
        return verifier.is_valid()
    except ConnectionError:
        time.sleep(2 ** attempt)
raise

from cryptography.x509 import ocsp

def responder_status_is_usable(ocsp_bytes):
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    return resp.response_status in (
        ocsp.OCSPResponseStatus.SUCCESSFUL,
        ocsp.OCSPResponseStatus.UNAUTHORIZED,
    )

from redis.exceptions import ConnectionError as RedisConnectionError

for attempt in range(3):
    try:
        return verifier.is_valid()
    except RedisConnectionError as e:
        if 'failed to retrieve a successful response' in str(e):
            time.sleep(2 ** attempt)  # TRY_LATER is transient
            continue
        raise
raise

When it happens

Trigger: The OCSP responder returns a non-success top-level response_status (any value other than SUCCESSFUL or UNAUTHORIZED). Common during responder maintenance (TRY_LATER), malformed requests (MALFORMED_REQUEST), responder bugs (INTERNAL_ERROR), or when the responder requires a signed request (SIG_REQUIRED).

Common situations: Responder temporarily returning TRY_LATER during a maintenance window; malformed OCSP request due to a corrupted/unsupported cert encoding; responder INTERNAL_ERROR from a backend outage; SIG_REQUIRED when the responder policy mandates signed OCSP requests; network appliance mangling the request body.

Related errors

• delegate not authorized for ocsp signing
• failed to fetch ocsp certificate
• no certificates found for the responder
• failed to fetch issuer certificate
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/04f9c3884fc56d5a. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:64

    except InvalidSignature:
        raise ConnectionError("failed to valid ocsp response")


def _check_certificate(issuer_cert, ocsp_bytes, validate=True):
    """A wrapper the return the validity of a known ocsp certificate"""

    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)

    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:
        raise AuthorizationError("you are not authorized to view this ocsp certificate")
    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:
        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:
            raise ConnectionError(
                f"Received an {str(ocsp_response.certificate_status).split('.')[1]} "
                "ocsp certificate status"
            )
    else:
        raise ConnectionError(
            "failed to retrieve a successful response from the ocsp responder"
        )

    if ocsp_response.this_update >= datetime.datetime.now():
        raise ConnectionError("ocsp certificate was issued in the future")

    if (
        ocsp_response.next_update
        and ocsp_response.next_update < datetime.datetime.now()
    ):
        raise ConnectionError("ocsp certificate has invalid update - in the past")

    responder_name = ocsp_response.responder_name
    issuer_hash = ocsp_response.issuer_key_hash
    responder_hash = ocsp_response.responder_key_hash

    cert_to_validate = issuer_cert
    if (

View on GitHub (pinned to 6a6b581b48)