redis/redis-py · error · ConnectionError

no ocsp servers in certificate

Error message

no ocsp servers in certificate

What it means

Raised as a ConnectionError by OCSPVerifier._certificate_components (redis/ocsp.py:239) when the AIA extension exists but contains no entries with access_method == AuthorityInformationAccessOID.OCSP. The code finds CA_ISSUERS entries (used to fetch the issuer) but when filtering for OCSP entries the list is empty, so ocsps[0] raises IndexError which is converted to this ConnectionError. Without an OCSP responder URL the verifier cannot query revocation status.

Solutions

1. Re-issue the certificate with an OCSP access method in AIA: authorityInfoAccess = OCSP;URI:http://responder/ocsp.
2. If the CA only supports CRL, switch the client to CRL-based revocation checking instead of OCSPVerifier.
3. Disable revocation checking for this endpoint only after an explicit risk decision if no OCSP/CRL is available.
4. Confirm the CA profile populates both caIssuers and OCSP access methods.

Example fix

# before - AIA has caIssuers but no OCSP entry
verifier.is_valid()  # ConnectionError: no ocsp servers in certificate

# after - re-issue cert with the OCSP access method in AIA
# authorityInfoAccess = OCSP;URI:http://ocsp.example.com
# authorityInfoAccess = caIssuers;URI:http://ca.example.com/ca.crt

from cryptography import x509
from cryptography.x509.oid import (
    ExtensionOID,
    AuthorityInformationAccessOID,
)

def cert_advertises_ocsp_url(cert):
    try:
        aia = cert.extensions.get_extension_for_oid(
            ExtensionOID.AUTHORITY_INFORMATION_ACCESS
        ).value
    except x509.ExtensionNotFound:
        return False
    return any(i.access_method == AuthorityInformationAccessOID.OCSP for i in aia)

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'no ocsp servers in certificate' in str(e):
        logging.warning('AIA has no OCSP entry - re-issue cert or switch to CRL-based checking')
    raise

When it happens

Trigger: OCSPVerifier extracts AIA and it includes CA Issuers but zero OCSP access methods. The cert advertises where to get the issuer cert but not where to query OCSP — common when a CA provides only CRL-based revocation or partially configures AIA.

Common situations: CA includes only caIssuers in AIA (CRL-only revocation model); partial AIA configuration in the CA profile; cert predates the deployment's OCSP responder; responder decommissioned but CA Issuers retained.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• No AIA information present in ssl certificate
• no ocsp response present
• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/3c0ad6cf903ee6c2. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:239

            for i in aia
            if i.access_method == x509.oid.AuthorityInformationAccessOID.CA_ISSUERS
        ]
        try:
            issuer = issuers[0].access_location.value
        except IndexError:
            issuer = None

        # now, the series of ocsp server entries
        ocsps = [
            i
            for i in aia
            if i.access_method == x509.oid.AuthorityInformationAccessOID.OCSP
        ]

        try:
            ocsp = ocsps[0].access_location.value
        except IndexError:
            raise ConnectionError("no ocsp servers in certificate")

        return cert, issuer, ocsp

    def components_from_direct_connection(self):
        """Return the certificate, primary issuer, and primary ocsp server
        from the host defined by the socket. This is useful in cases where
        different certificates are occasionally presented.
        """

        pem = ssl.get_server_certificate((self.HOST, self.PORT), ca_certs=self.CA_CERTS)
        cert = x509.load_pem_x509_certificate(pem.encode(), backends.default_backend())
        return self._certificate_components(cert)

    def build_certificate_url(self, server, cert, issuer_cert):
        """Return the complete url to the ocsp"""
        orb = ocsp.OCSPRequestBuilder()

        # add_certificate returns an initialized OCSPRequestBuilder

View on GitHub (pinned to 6a6b581b48)