redis/redis-py · error · ConnectionError

no certificates found for the responder

Error message

no certificates found for the responder

What it means

Raised as a ConnectionError by _check_certificate (redis/ocsp.py:97) when the OCSP response uses a delegated responder (responder does not match the issuer) and no certificate in ocsp_response.certificates matches the responder identity (by name or key hash) and chains to the issuer. Without the responder's cert, its signature cannot be verified, so the response is rejected.

Solutions

1. Confirm the responder includes its delegated signing certificate in the OCSP response (RFC 6960 recommends it).
2. Verify the issuer cert used for matching is the correct one for the peer certificate.
3. Check that the public-key hashing in _get_pubkey_hash matches the responder's key type (RSA/EC handled explicitly; other key types use SubjectPublicKeyInfo).
4. If the responder legitimately omits the cert, obtain it out-of-band or use an authorized direct responder that signs with the CA's own key.

Example fix

# before - delegated responder did not embed its signing cert
_check_certificate(issuer_cert, ocsp_bytes)  # ConnectionError: no certificates found for the responder

# after - use a responder that includes the delegated cert, or one that signs with the issuer key
# (configure OCSP responder to embed responder cert per RFC 6960 sec 4.2.2.2)

from cryptography.x509 import ocsp

def response_embeds_responder_cert(ocsp_bytes, issuer_cert, responder_name, responder_hash):
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    # mirror the matching logic in _get_certificates
    return len(resp.certificates) > 0

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    _check_certificate(issuer_cert, ocsp_bytes)
except RedisConnectionError as e:
    if 'no certificates found for the responder' in str(e):
        logging.warning('Delegated responder did not embed its signing cert')
    raise

When it happens

Trigger: OCSP verification with a delegated responder where the embedded certs list is empty or contains no cert whose subject==responder_name / public key hash==responder_key_hash and whose issuer==issuer_cert.subject. The IndexError on responder_certs[0] is caught and converted to this ConnectionError.

Common situations: Responder omitted its signing cert from the response (non-standard/misconfigured responder); responder used a key hash/name the client computes differently (encoding mismatch in _get_pubkey_hash for non-RSA/non-EC keys); chain mismatch where the embedded cert's issuer doesn't match the selected issuer cert; outdated responder cert after a delegation rotation.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• delegate not authorized for ocsp signing
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…
• failed to fetch issuer certificate
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/40f60b81cdc31133. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:97

    responder_hash = ocsp_response.responder_key_hash

    cert_to_validate = issuer_cert
    if (
        responder_name is not None
        and responder_name == issuer_cert.subject
        or responder_hash == issuer_hash
    ):
        cert_to_validate = issuer_cert
    else:
        certs = ocsp_response.certificates
        responder_certs = _get_certificates(
            certs, issuer_cert, responder_name, responder_hash
        )

        try:
            responder_cert = responder_certs[0]
        except IndexError:
            raise ConnectionError("no certificates found for the responder")

        ext = responder_cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
        if ext is None or x509.oid.ExtendedKeyUsageOID.OCSP_SIGNING not in ext.value:
            raise ConnectionError("delegate not authorized for ocsp signing")
        cert_to_validate = responder_cert

    if validate:
        _verify_response(cert_to_validate, ocsp_response)
    return True


def _get_certificates(certs, issuer_cert, responder_name, responder_hash):
    if responder_name is None:
        certificates = [
            c
            for c in certs
            if _get_pubkey_hash(c) == responder_hash and c.issuer == issuer_cert.subject
        ]

View on GitHub (pinned to 6a6b581b48)