redis/redis-py · error · ValueError

Invalid ssl verify flag: {flag}

Error message

Invalid ssl verify flag: {flag}

What it means

Raised as a ValueError by parse_ssl_verify_flags (connection.py:2296-2307) when a flag token in ssl_include_verify_flags / ssl_exclude_verify_flags does not exist as an attribute on ssl.VerifyFlags. The function is registered in URL_QUERY_ARGUMENT_PARSERS (line 2321-2322), so it runs when these flags are supplied via a rediss:// URL query string.

Source

Thrown at redis/connection.py:2305

def to_bool(value):
    if value is None or value == "":
        return None
    if isinstance(value, str) and value.upper() in FALSE_STRINGS:
        return False
    return bool(value)


def parse_ssl_verify_flags(value):
    # flags are passed in as a string representation of a list,
    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN
    verify_flags_str = value.replace("[", "").replace("]", "")

    verify_flags = []
    for flag in verify_flags_str.split(","):
        flag = flag.strip()
        if not hasattr(VerifyFlags, flag):
            raise ValueError(f"Invalid ssl verify flag: {flag}")
        verify_flags.append(getattr(VerifyFlags, flag))
    return verify_flags


URL_QUERY_ARGUMENT_PARSERS = {
    "db": int,
    "socket_timeout": float,
    "socket_connect_timeout": float,
    "socket_read_size": int,
    "socket_keepalive": to_bool,
    "retry_on_timeout": to_bool,
    "retry_on_error": list,
    "max_connections": int,
    "health_check_interval": int,
    "ssl_check_hostname": to_bool,
    "ssl_include_verify_flags": parse_ssl_verify_flags,
    "ssl_exclude_verify_flags": parse_ssl_verify_flags,
    "ssl_min_version": int,

View on GitHub (pinned to da03cdc7e8)

Solutions

1. Use only valid ssl.VerifyFlags names (e.g. VERIFY_X509_STRICT, VERIFY_X509_TRUSTED_FIRST, VERIFY_X509_PARTIAL_CHAIN). Inspect with `python -c "import ssl; print([n for n in dir(ssl.VerifyFlags) if n.startswith('VERIFY')]"`.
2. Multiple flags are comma-separated in the URL: ?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_X509_PARTIAL_CHAIN.
3. If passing programmatically (not via URL), pass the ssl.VerifyFlags constants directly in a list rather than strings.

Example fix

# before
url = "rediss://h:6379?ssl_include_verify_flags=VERIFY_X509_TRUSTEDFIRST"
redis.Redis.from_url(url)

# after (correct name)
url = "rediss://h:6379?ssl_include_verify_flags=VERIFY_X509_TRUSTED_FIRST"
# or programmatically
import ssl
redis.Redis.from_url("rediss://h", ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_TRUSTED_FIRST])

import ssl
VALID_FLAGS = {n for n in dir(ssl.VerifyFlags) if n.startswith("VERIFY")}

def validate_flag_list(raw: str):
    tokens = [t.strip() for t in raw.replace("[","").replace("]","").split(",") if t.strip()]
    bad = [t for t in tokens if t not in VALID_FLAGS]
    if bad:
        raise ValueError(f"Unknown ssl verify flags: {bad}; valid: {sorted(VALID_FLAGS)}")
    return tokens

url = f"rediss://h?ssl_include_verify_flags={','.join(validate_flag_list(raw))}"

import ssl
def is_valid_verify_flag(name: str) -> bool:
    return hasattr(ssl.VerifyFlags, name)

try:
    client = redis.Redis.from_url(url_with_flags)
except ValueError as e:
    if "Invalid ssl verify flag" in str(e):
        # strip the offending flag from the URL or pass constants directly
        client = redis.Redis.from_url("rediss://h", ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_STRICT])
    else:
        raise

When it happens

Trigger: Passing a rediss:// URL containing ?ssl_include_verify_flags=VERIFY_BOGUS or a misspelled flag name. The function splits on commas, strips brackets, and calls hasattr(VerifyFlags, flag) for each token; any unknown name raises.

Common situations: Typos in flag names (e.g. VERIFY_X509_STRICK), flags from a different Python/OpenSSL version than the runtime supports, copy-pasting flags documented for another TLS library, passing the numeric value as a string instead of the symbolic name.

Related errors

• Invalid ssl verify flag: {flag}
• Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}
• Either an OCSP staple or pure OCSP connection must be valida
• Redis URL must specify one of the following schemes (redis:/
• Invalid value for '{name}' in connection URL.

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/8626a88f67bbede9.json. Report an issue: GitHub.