redis/redis-py · error · ConnectionError

No AIA information present in ssl certificate

Error message

No AIA information present in ssl certificate

What it means

Raised as a ConnectionError by OCSPVerifier._certificate_components (redis/ocsp.py:216) when the peer certificate has no Authority Information Access (AIA) extension (x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS). get_extension_for_oid raises ExtensionNotFound, which is caught and re-raised as this ConnectionError. The AIA extension is where the certificate advertises its OCSP responder URL(s) and CA issuer URL; without it the verifier cannot discover where to check revocation.

Solutions

1. Re-issue the certificate with an AIA extension containing at least the OCSP responder URL (and ideally the CA Issuers URL).
2. If OCSP checking is not required for this deployment, disable OCSP verification for that endpoint.
3. Use CRL-based revocation checking instead if the CA provides CRL distribution points but not OCSP/AIA.
4. Confirm the cert generation profile (openssl.cnf) includes authorityInfoAccess = OCSP;URI:...

Example fix

# before - cert has no AIA extension
verifier.is_valid()  # ConnectionError: No AIA information present in ssl certificate

# after - re-issue the cert with AIA (openssl.cnf)
# [ v3_ext ]
# authorityInfoAccess = OCSP;URI:http://ocsp.internal-ca/ca/ocsp
# authorityInfoAccess = caIssuers;URI:http://ocsp.internal-ca/ca.crt
# then regenerate and redeploy the certificate

from cryptography import x509
from cryptography.x509.oid import ExtensionOID

def cert_has_aia(cert):
    try:
        cert.extensions.get_extension_for_oid(ExtensionOID.AUTHORITY_INFORMATION_ACCESS)
        return True
    except x509.ExtensionNotFound:
        return False

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'No AIA information' in str(e):
        logging.warning('Cert lacks AIA - re-issue with OCSP responder URL or disable OCSP')
    raise

When it happens

Trigger: OCSPVerifier.components_from_socket / components_from_direct_connection extract AIA from the cert, but the cert was issued without an AIA extension. Internal/private CAs frequently omit AIA; self-signed certs never include it.

Common situations: Private/internal CA that does not embed AIA in issued certs; self-signed certificate; older CA tooling that didn't populate AIA; cert generated with openssl without the AIA extension configured.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no ocsp servers in certificate
• no ocsp response present
• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/58130283930e50bd. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:216

        if der is False:
            raise ConnectionError("no certificate found for ssl peer")
        cert = self._bin2ascii(der)
        return self._certificate_components(cert)

    def _certificate_components(self, cert):
        """Given an SSL certificate, retract the useful components for
        validating the certificate status with an OCSP server.

        Args:
            cert ([bytes]): A PEM encoded ssl certificate
        """

        try:
            aia = cert.extensions.get_extension_for_oid(
                x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS
            ).value
        except cryptography.x509.extensions.ExtensionNotFound:
            raise ConnectionError("No AIA information present in ssl certificate")

        # fetch certificate issuers
        issuers = [
            i
            for i in aia
            if i.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS
        ]
        try:
            issuer = issuers[0].access_location.value
        except IndexError:
            issuer = None

        # now, the series of ocsp server entries
        ocsps = [
            i
            for i in aia
            if i.access_method == x509.oid.AuthorityInformationAccessOID.OCSP
        ]

View on GitHub (pinned to 6a6b581b48)