redis/redis-py · error · ConnectionError

no certificate found for ssl peer

Error message

no certificate found for ssl peer

What it means

Raised as a ConnectionError by OCSPVerifier.components_from_socket (redis/ocsp.py:199) when self.SOCK.getpeercert(True) returns False, meaning the SSL socket has no peer certificate available. getpeercert(binary_form=True) returns False when the handshake hasn't completed, no cert was provided by the peer, or the socket is not actually TLS-wrapped. Without the peer cert, OCSP validation cannot start.

Solutions

1. Ensure the socket passed to OCSPVerifier is an SSLSocket from a completed TLS handshake (wrap with SSLContext and complete the handshake before verifying).
2. Confirm the server actually presents a certificate (test with openssl s_client).
3. Do not call components_from_socket before handshake completion; perform the verify step after connect().
4. Verify no proxy/LB is terminating TLS before the client socket.

Example fix

# before - raw socket handed to OCSPVerifier, no TLS
verifier = OCSPVerifier(raw_sock, host, port)
verifier.is_valid()  # ConnectionError: no certificate found for ssl peer

# after - wrap in SSLContext and complete handshake first
ctx = ssl.create_default_context()
ssl_sock = ctx.wrap_socket(raw_sock, server_hostname=host)
verifier = OCSPVerifier(ssl_sock, host, port)
verifier.is_valid()

import ssl

def socket_has_peer_cert(sock):
    return isinstance(sock, ssl.SSLSocket) and bool(sock.getpeercert(True))

def is_tls_socket_with_peer_cert(sock) -> bool:
    import ssl
    return isinstance(sock, ssl.SSLSocket) and sock.getpeercert(True) not in (False, None, b'')

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'no certificate found for ssl peer' in str(e):
        logging.error('Socket has no peer cert - wrap in SSLContext and complete handshake first')
    raise

When it happens

Trigger: Calling OCSPVerifier(sock, host, port).is_valid() (or components_from_socket directly) on a socket where getpeercert(True) returns False. Happens if the socket isn't wrapped in an SSLContext, the TLS handshake hasn't finished, or the server sent no certificate (e.g. anonymous cipher).

Common situations: Passing a plain (non-SSL) socket to OCSPVerifier; calling components_from_socket before the handshake completes; server misconfigured to use an anonymous/non-cipher TLS suite; TLS stripped by a proxy so the client socket sees plaintext; verification attempted on a re-used socket whose TLS state is gone.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/c5abbe61137089e8. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:199

        self.PORT = port
        self.CA_CERTS = ca_certs

    def _bin2ascii(self, der):
        """Convert SSL certificates in a binary (DER) format to ASCII PEM."""

        pem = ssl.DER_cert_to_PEM_cert(der)
        cert = x509.load_pem_x509_certificate(pem.encode(), backends.default_backend())
        return cert

    def components_from_socket(self):
        """This function returns the certificate, primary issuer, and primary ocsp
        server in the chain for a socket already wrapped with ssl.
        """

        # convert the binary certificate to text
        der = self.SOCK.getpeercert(True)
        if der is False:
            raise ConnectionError("no certificate found for ssl peer")
        cert = self._bin2ascii(der)
        return self._certificate_components(cert)

    def _certificate_components(self, cert):
        """Given an SSL certificate, retract the useful components for
        validating the certificate status with an OCSP server.

        Args:
            cert ([bytes]): A PEM encoded ssl certificate
        """

        try:
            aia = cert.extensions.get_extension_for_oid(
                x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS
            ).value
        except cryptography.x509.extensions.ExtensionNotFound:
            raise ConnectionError("No AIA information present in ssl certificate")

View on GitHub (pinned to 6a6b581b48)