redis/redis-py · error · ConnectionError

no ocsp response present

Error message

no ocsp response present

What it means

Raised as a ConnectionError by ocsp_staple_verifier (redis/ocsp.py:149) when ocsp_bytes is b'' or None — i.e. the server did not provide a stapled OCSP response (RFC 6066 status_request) during the TLS handshake. The staple verifier is invoked by the ssl_ocsp_client_callback when OCSP stapling is configured, and an empty staple means the server ignored or could not satisfy the status_request.

Solutions

1. Enable OCSP stapling on the server side (stunnel/Redis TLS config) so it fetches and presents a staple during the handshake.
2. If stapling is optional for your deployment, configure the client to tolerate a missing staple rather than hard-failing.
3. Confirm the server certificate supports/requests stapling (must-staple TLS feature extension) and that the responder is reachable from the server.
4. Verify the TLS stack surfaces the staple to the callback (some proxies terminate TLS and discard it).

Example fix

# before - client requires a staple the server doesn't send
redis.Redis(host=h, port=p, ssl=True, ssl_ocsp_context=staple_ctx)  # ConnectionError: no ocsp response present

# after - enable stapling on the server (stunnel example)
# [redis]
# ocsp = on
# ocspResponderURL = http://ocsp.example.com
# then the server staples; the client verifier receives non-empty ocsp_bytes

def staple_present(ocsp_bytes):
    return ocsp_bytes not in (b'', None)

# in the callback:
if not staple_present(ocsp_bytes):
    logging.warning('Server did not staple an OCSP response')
    # decide policy: fail (raise) or allow based on your security posture

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    ocsp_staple_verifier(con, ocsp_bytes, expected)
except RedisConnectionError as e:
    if 'no ocsp response present' in str(e):
        logging.warning('No OCSP staple - enable stapling on the server or relax the requirement')
    raise

When it happens

Trigger: Configuring a Redis client with ssl_ocsp_context / set_ocsp_client_callback pointing at ocsp_staple_verifier, connecting to a server that does not support OCSP stapling or omitted the staple. The verifier is called with empty bytes and immediately rejects.

Common situations: Server (Redis/stunnel) not configured for OCSP stapling; TLS terminator strips the status_request extension; server's responder was unreachable so it skipped the staple; client requires stapling (must-staple cert) but the deployment never enabled it.

Related errors

• No AIA information present in ssl certificate
• no ocsp servers in certificate
• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/179b2e6516bd02de. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:149

        h = pubkey.public_bytes(Encoding.DER, PublicFormat.PKCS1)
    elif isinstance(pubkey, EllipticCurvePublicKey):
        h = pubkey.public_bytes(Encoding.X962, PublicFormat.UncompressedPoint)
    else:
        h = pubkey.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)

    sha1 = Hash(SHA1(), backend=backends.default_backend())
    sha1.update(h)
    return sha1.finalize()


def ocsp_staple_verifier(con, ocsp_bytes, expected=None):
    """An implementation of a function for set_ocsp_client_callback in PyOpenSSL.

    This function validates that the provide ocsp_bytes response is valid,
    and matches the expected, stapled responses.
    """
    if ocsp_bytes in [b"", None]:
        raise ConnectionError("no ocsp response present")

    issuer_cert = None
    peer_cert = con.get_peer_certificate().to_cryptography()
    for c in con.get_peer_cert_chain():
        cert = c.to_cryptography()
        if cert.subject == peer_cert.issuer:
            issuer_cert = cert
            break

    if issuer_cert is None:
        raise ConnectionError("no matching issuer cert found in certificate chain")

    if expected is not None:
        e = x509.load_pem_x509_certificate(expected)
        if peer_cert != e:
            raise ConnectionError("received and expected certificates do not match")

    return _check_certificate(issuer_cert, ocsp_bytes)

View on GitHub (pinned to 6a6b581b48)