redis/redis-py · error · RedisError

Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}

Error message

Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}

What it means

Raised by SSLConnection.__init__ (connection.py:2130-2133) when ssl_cert_reqs is passed as a string that is not one of the recognized keys: "none", "optional", or "required" (mapped at lines 2125-2129 to ssl.CERT_NONE / CERT_OPTIONAL / CERT_REQUIRED). Numeric/enum values bypass this check; only invalid string spellings trip it.

Source

Thrown at redis/connection.py:2131

        Raises:
            RedisError
        """  # noqa
        if not SSL_AVAILABLE:
            raise RedisError("Python wasn't built with SSL support")

        self.keyfile = ssl_keyfile
        self.certfile = ssl_certfile
        if ssl_cert_reqs is None:
            ssl_cert_reqs = ssl.CERT_NONE
        elif isinstance(ssl_cert_reqs, str):
            CERT_REQS = {  # noqa: N806
                "none": ssl.CERT_NONE,
                "optional": ssl.CERT_OPTIONAL,
                "required": ssl.CERT_REQUIRED,
            }
            if ssl_cert_reqs not in CERT_REQS:
                raise RedisError(
                    f"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}"
                )
            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]
        self.cert_reqs = ssl_cert_reqs
        self.ssl_include_verify_flags = ssl_include_verify_flags
        self.ssl_exclude_verify_flags = ssl_exclude_verify_flags
        self.ca_certs = ssl_ca_certs
        self.ca_data = ssl_ca_data
        self.ca_path = ssl_ca_path
        self.check_hostname = (
            ssl_check_hostname if self.cert_reqs != ssl.CERT_NONE else False
        )
        self.certificate_password = ssl_password
        self.ssl_validate_ocsp = ssl_validate_ocsp
        self.ssl_validate_ocsp_stapled = ssl_validate_ocsp_stapled
        self.ssl_ocsp_context = ssl_ocsp_context
        self.ssl_ocsp_expected_cert = ssl_ocsp_expected_cert
        self.ssl_min_version = ssl_min_version

View on GitHub (pinned to da03cdc7e8)

Solutions

Use one of the three accepted string aliases: "none", "optional", or "required".
Pass the ssl module constant instead of a string (ssl.CERT_NONE / ssl.CERT_OPTIONAL / ssl.CERT_REQUIRED), which are ints and skip the string-validation branch.
If the value comes from config/env, validate it against {"none","optional","required"} before constructing the client.

Example fix

# before
client = redis.Redis.from_url("rediss://h", ssl_cert_reqs="require")

# after
client = redis.Redis.from_url("rediss://h", ssl_cert_reqs="required")
# or
import ssl
client = redis.Redis.from_url("rediss://h", ssl_cert_reqs=ssl.CERT_REQUIRED)

Defensive patterns

Strategy: validation

Validate before calling

import ssl
VALID_CERT_REQS = {"none", "optional", "required"}

def normalize_cert_reqs(v):
    if isinstance(v, str):
        assert v in VALID_CERT_REQS, f"ssl_cert_reqs must be one of {VALID_CERT_REQS}"
    return v

client = redis.Redis.from_url("rediss://h", ssl_cert_reqs=normalize_cert_reqs(my_val))

Type guard

from typing import Union
import ssl

def is_valid_cert_reqs(v) -> bool:
    if isinstance(v, int) and v in (ssl.CERT_NONE, ssl.CERT_OPTIONAL, ssl.CERT_REQUIRED):
        return True
    return v in ("none", "optional", "required")

Try / catch

from redis.exceptions import RedisError
try:
    client = redis.Redis(ssl_cert_reqs=req)
except RedisError as e:
    if "Invalid SSL Certificate Requirements" in str(e):
        req = "required"
        client = redis.Redis(ssl_cert_reqs=req)
    else:
        raise

Prevention

Standardize on the ssl module constants (ssl.CERT_REQUIRED) in config rather than strings.
Validate config-sourced strings against {none,optional,required} before constructing the client.
Document the three accepted aliases where TLS config lives.

When it happens

Trigger: Passing ssl_cert_reqs="require", "CERT_REQUIRED", "yes", or any typo as a string to SSLConnection or via a client/ConnectionPool. Note: the default is the string "required" (line 2076), which IS valid — only other strings raise.

Common situations: Copying config from code that uses the ssl module constants directly (ssl.CERT_REQUIRED is an int, valid) into a string form with the wrong spelling; passing the enum name "CERT_REQUIRED" instead of the redis alias "required"; config files / env vars feeding an unrecognized value.

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/aae86099ee6a86b6.json. Report an issue: GitHub.