redis/redis-py · error · ValueError

Invalid ssl verify flag

Error message

Invalid ssl verify flag: {flag}

What it means

Raised as ValueError(f'Invalid ssl verify flag: {flag}') by parse_ssl_verify_flags, which is the URL-query parser for ssl_include_verify_flags and ssl_exclude_verify_flags. Each comma-separated token must be an attribute name on ssl.VerifyFlags (e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN). A token that is not such an attribute is rejected.

Solutions

1. Use only valid ssl.VerifyFlags attribute names (run [name for name in dir(ssl.VerifyFlags) if name.startswith('VERIFY_')] to list them).
2. Keep the names uppercase and comma-separated, e.g. ?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_X509_PARTIAL_CHAIN.
3. If you do not need custom verify flags, omit the query parameter entirely.

Example fix

# before
r = redis.Redis.from_url('rediss://host?ssl_include_verify_flags=VERIFY_STRICT')
# after
r = redis.Redis.from_url('rediss://host?ssl_include_verify_flags=VERIFY_X509_STRICT')

import ssl

def valid_verify_flags(flags_csv: str) -> bool:
    names = {n for n in dir(ssl.VerifyFlags) if n.startswith('VERIFY_')}
    return all(f.strip() in names for f in flags_csv.replace('[', '').replace(']', '').split(',') if f.strip())

import ssl

def is_valid_flag_token(token: str) -> bool:
    return hasattr(ssl.VerifyFlags, token)

try:
    r = redis.Redis.from_url(url_with_flags)
except ValueError as e:
    if 'Invalid ssl verify flag' in str(e):
        # strip the flags param and retry with defaults
        r = redis.Redis.from_url(url_without_flags)
    else:
        raise

When it happens

Trigger: Passing a rediss:// URL with ?ssl_include_verify_flags=VERIFY_X509_TRUSTED_FIRST (not a real flag) or ?ssl_include_verify_flags=verify_x509_strict (wrong case). Typos in flag names in the query string.

Common situations: Hand-typed connection URLs with verify-flag query params. Copying flag names from outdated docs. Case mismatch (the flags are uppercase). Passing flags valid for a different OpenSSL binding.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid SSL Certificate Requirements Flag
• Invalid value for ' ' in connection URL.
• Redis URL must specify one of the following schemes…
• Cache must implement CacheInterface
• cryptography is not installed.

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/8626a88f67bbede9. Report an issue: GitHub.

Appendix: source

Thrown at redis/connection.py:2321

def to_bool(value):
    if value is None or value == "":
        return None
    if isinstance(value, str) and value.upper() in FALSE_STRINGS:
        return False
    return bool(value)


def parse_ssl_verify_flags(value):
    # flags are passed in as a string representation of a list,
    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN
    verify_flags_str = value.replace("[", "").replace("]", "")

    verify_flags = []
    for flag in verify_flags_str.split(","):
        flag = flag.strip()
        if not hasattr(VerifyFlags, flag):
            raise ValueError(f"Invalid ssl verify flag: {flag}")
        verify_flags.append(getattr(VerifyFlags, flag))
    return verify_flags


URL_QUERY_ARGUMENT_PARSERS = {
    "db": int,
    "socket_timeout": float,
    "socket_connect_timeout": float,
    "socket_read_size": int,
    "socket_keepalive": to_bool,
    "retry_on_timeout": to_bool,
    "retry_on_error": list,
    "max_connections": int,
    "health_check_interval": int,
    "ssl_check_hostname": to_bool,
    "ssl_include_verify_flags": parse_ssl_verify_flags,
    "ssl_exclude_verify_flags": parse_ssl_verify_flags,
    "ssl_min_version": int,

View on GitHub (pinned to 6a6b581b48)