What causes "no issuers found in certificate chain" in redis/redis-py?

Disable OCSP validation (remove ssl_ocsp_context) if your PKI does not provide AIA CA Issuers URLs.

redis/redis-py · error · ConnectionError

no issuers found in certificate chain

Error message

no issuers found in certificate chain

What it means

Raised by OCSPValidator.is_valid (redis/ocsp.py:302) on the primary code path. OCSP validation needs the issuer certificate to verify the server cert's revocation status; the issuer URL is read from the cert's Authority Information Access (AIA) CA Issuers entry. If components_from_socket() returns issuer_url is None (the AIA extension has no CA_ISSUERS access method), the library raises redis.exceptions.ConnectionError because it cannot fetch the issuer certificate required to build the OCSP request.

Source

Thrown at redis/ocsp.py:302

        }
        r = requests.get(ocsp_url, headers=header)
        if not r.ok:
            raise ConnectionError("failed to fetch ocsp certificate")
        return _check_certificate(issuer_cert, r.content, True)

    def is_valid(self):
        """Returns the validity of the certificate wrapping our socket.
        This first retrieves for validate the certificate, issuer_url,
        and ocsp_server for certificate validate. Then retrieves the
        issuer certificate from the issuer_url, and finally checks
        the validity of OCSP revocation status.
        """

        # validate the certificate
        try:
            cert, issuer_url, ocsp_server = self.components_from_socket()
            if issuer_url is None:
                raise ConnectionError("no issuers found in certificate chain")
            return self.check_certificate(ocsp_server, cert, issuer_url)
        except AuthorizationError:
            cert, issuer_url, ocsp_server = self.components_from_direct_connection()
            if issuer_url is None:
                raise ConnectionError("no issuers found in certificate chain")
            return self.check_certificate(ocsp_server, cert, issuer_url)

View on GitHub (pinned to da03cdc7e8)

Solutions

Disable OCSP validation (remove ssl_ocsp_context) if your PKI does not provide AIA CA Issuers URLs.
Re-issue the server certificate with a complete AIA extension containing both OCSP and CA Issuers URLs.
Use a public CA-issued certificate that includes AIA CA Issuers information.

Example fix

# before
client = redis.Redis(host='...', ssl=True, ssl_ocsp_context=ctx)
# after
client = redis.Redis(host='...', ssl=True)

Defensive patterns

Strategy: validation

Validate before calling

from cryptography import x509
from cryptography.hazmat.backends import default_backend

def cert_has_issuer_aia(cert_pem: bytes) -> bool:
    cert = x509.load_pem_x509_certificate(cert_pem, default_backend())
    try:
        aia = cert.extensions.get_extension_for_oid(
            x509.oid.ExtensionOID.AUTHORITY_INFORMATION_ACCESS
        ).value
    except x509.extensions.ExtensionNotFound:
        return False
    return any(
        d.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS
        for d in aia
    )

# Only enable OCSP if the cert supports it
ctx = ocsp_ctx if cert_has_issuer_aia(server_cert_pem) else None

Try / catch

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    client = redis.Redis(host=HOST, port=PORT, ssl=True, ssl_ocsp_context=ctx)
    client.ping()
except RedisConnectionError as e:
    if 'no issuers found in certificate chain' in str(e):
        client = redis.Redis(host=HOST, port=PORT, ssl=True)  # drop OCSP
    else:
        raise

Prevention

Inspect certs with `openssl x509 -in cert.pem -noout -text | grep -A2 'Authority Information Access'` before enabling OCSP.
Prefer public CA-issued certificates that include complete AIA extensions.
Document which deployments require OCSP and which certs satisfy the requirement.

When it happens

Trigger: Connecting with TLS + OCSP validation enabled (ssl_ocsp_context set) where the server certificate presented on the TLS socket has an AIA extension lacking a CA Issuers URL, or has no AIA extension entry for CA_ISSUERS. The branch is reached when self.components_from_socket() succeeds but returns issuer_url=None.

Common situations: Self-signed certificates; certificates issued by a private/internal CA that does not populate AIA extensions; certificates where only the OCSP responder URL is present but the CA Issuers URL is omitted; lab/staging environments with minimalist cert generation.

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/621315f399c07121.json. Report an issue: GitHub.