redis/redis-py · warning · ConnectionError

ocsp certificate has invalid update - in the past

Error message

ocsp certificate has invalid update - in the past

What it means

Raised as a ConnectionError by _check_certificate (redis/ocsp.py:75) when next_update is present and ocsp_response.next_update < now(). The nextUpdate field is the responder's guarantee of freshness; a past nextUpdate means the response is stale and the revocation status can no longer be trusted, so redis-py rejects it.

Solutions

1. Force a fresh OCSP fetch (drop any cached/stapled response) so the responder returns a current nextUpdate.
2. Synchronize the client clock to rule out skew making a valid nextUpdate appear expired.
3. If using OCSP stapling, ensure the server refreshes its staple frequently enough to stay ahead of nextUpdate.
4. Investigate responder availability if fresh fetches still return already-expired responses.

Example fix

# before - stale cached OCSP response past nextUpdate
verifier.is_valid()  # ConnectionError: ocsp certificate has invalid update - in the past

# after - fetch a fresh response (no cache) and sync clock
# 1. Clear any local OCSP cache
# 2. Run direct validation: verifier.is_valid() fetches from the responder
# 3. Confirm responder returns nextUpdate > now

import datetime
from cryptography.x509 import ocsp

def ocsp_response_is_fresh(ocsp_bytes):
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    if resp.next_update is None:
        return True
    return resp.next_update > datetime.datetime.now()

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    if 'invalid update' in str(e) and 'past' in str(e):
        logging.warning('Stale OCSP response (nextUpdate passed) - force refresh')
    raise

When it happens

Trigger: OCSP verification runs on a cached/stale response whose nextUpdate has passed. next_update is optional, so this only fires when the responder included it AND it is already in the past.

Common situations: Locally cached OCSP response not refreshed before its nextUpdate; responder outage preventing refresh while the cached copy expires; long-lived process holding a stapled response past its validity; clock skew making a valid nextUpdate appear past.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ocsp certificate was issued in the future
• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/0d3f2b3ad50ba1c2. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:75

    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:
        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:
            raise ConnectionError(
                f"Received an {str(ocsp_response.certificate_status).split('.')[1]} "
                "ocsp certificate status"
            )
    else:
        raise ConnectionError(
            "failed to retrieve a successful response from the ocsp responder"
        )

    if ocsp_response.this_update >= datetime.datetime.now():
        raise ConnectionError("ocsp certificate was issued in the future")

    if (
        ocsp_response.next_update
        and ocsp_response.next_update < datetime.datetime.now()
    ):
        raise ConnectionError("ocsp certificate has invalid update - in the past")

    responder_name = ocsp_response.responder_name
    issuer_hash = ocsp_response.issuer_key_hash
    responder_hash = ocsp_response.responder_key_hash

    cert_to_validate = issuer_cert
    if (
        responder_name is not None
        and responder_name == issuer_cert.subject
        or responder_hash == issuer_hash
    ):
        cert_to_validate = issuer_cert
    else:
        certs = ocsp_response.certificates
        responder_certs = _get_certificates(
            certs, issuer_cert, responder_name, responder_hash
        )

View on GitHub (pinned to 6a6b581b48)