redis/redis-py · critical · ConnectionError

failed to valid ocsp response

Error message

failed to valid ocsp response

What it means

Raised as a ConnectionError by _verify_response (redis/ocsp.py:47) when cryptography's pubkey.verify() raises InvalidSignature while checking the OCSP response signature against the issuer (or delegated responder) public key. A failed signature means the response was tampered with, generated by a different key than expected, or corrupted in transit — the OCSP response cannot be trusted. (Note: the message contains a long-standing typo 'valid' instead of 'validate'.)

Solutions

1. Treat this as a security-relevant failure — do not disable OCSP; instead investigate the chain, the responder, and the network path for tampering or a stale issuer.
2. Confirm the correct issuer certificate is being used for verification (matches peer_cert.issuer) so the right public key validates the signature.
3. Retry against the OCSP responder directly to rule out transient corruption; a persistent signature failure indicates a real trust problem.
4. If you must connect while investigating, fall back to a non-OCSP TLS path only after explicitly accepting the risk, and file an incident.

Example fix

# before - OCSP verification enabled, signature mismatch fails the connection
r = redis.Redis(host=host, port=port, ssl=True, ssl_ocsp_context=...)  # ConnectionError: failed to valid ocsp response

# after - verify issuer chain and responder before re-enabling; keep OCSP on
# 1. Inspect peer chain to confirm issuer cert selection
# 2. Fetch the OCSP response manually and verify with cryptography
# 3. Re-enable ssl_ocsp_context only after signature validates under the correct issuer

from cryptography.x509 import ocsp

def ocsp_response_signature_looks_intact(issuer_cert, ocsp_bytes):
    # basic precondition: response is loadable and successful before attempting verify
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    return resp.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'failed to valid ocsp response' in str(e):
        # signature mismatch - security-relevant; do not silently bypass
        logging.critical('OCSP signature verification failed: %s', e)
        raise
    raise

When it happens

Trigger: OCSP verification runs (via ocsp_staple_verifier for stapled responses, or OCSPVerifier.is_valid()/check_certificate() for direct validation) and the responder signature does not validate under the issuer's RSA/DSA/ECDSA public key. _check_certificate calls _verify_response(cert_to_validate, ocsp_response) with validate=True (default), so any signature mismatch surfaces here.

Common situations: A man-in-the-middle or compromised responder returning a forged OCSP response; the wrong issuer cert was selected from the chain (mismatched key); response bytes corrupted by a misbehaving proxy/LB; responder rotated its signing key but the chain/issuer used for verification is stale; clock skew combined with a key rotation boundary.

Related errors

• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…
• No AIA information present in ssl certificate

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/9fddc19bd34e5f82. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:47

                PKCS1v15(),
                ocsp_response.signature_hash_algorithm,
            )
        elif isinstance(pubkey, DSAPublicKey):
            pubkey.verify(
                ocsp_response.signature,
                ocsp_response.tbs_response_bytes,
                ocsp_response.signature_hash_algorithm,
            )
        elif isinstance(pubkey, EllipticCurvePublicKey):
            pubkey.verify(
                ocsp_response.signature,
                ocsp_response.tbs_response_bytes,
                ECDSA(ocsp_response.signature_hash_algorithm),
            )
        else:
            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)
    except InvalidSignature:
        raise ConnectionError("failed to valid ocsp response")


def _check_certificate(issuer_cert, ocsp_bytes, validate=True):
    """A wrapper the return the validity of a known ocsp certificate"""

    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)

    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:
        raise AuthorizationError("you are not authorized to view this ocsp certificate")
    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:
        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:
            raise ConnectionError(
                f"Received an {str(ocsp_response.certificate_status).split('.')[1]} "
                "ocsp certificate status"
            )
    else:
        raise ConnectionError(
            "failed to retrieve a successful response from the ocsp responder"

View on GitHub (pinned to 6a6b581b48)