redis/redis-py · error · ConnectionError

ocsp validation error

Error message

ocsp validation error

What it means

Raised as ConnectionError('ocsp validation error') in SSLConnection._wrap_socket_with_ssl after OCSPVerifier.is_valid() returns False. This means the pure-OCSP validation (ssl_validate_ocsp=True with cryptography installed) ran and concluded the certificate is invalid/revoked or the responder could not be reached in a way the verifier treats as failure. The socket is rejected, so the TLS connection is never established.

Solutions

1. Check the certificate's real revocation status (openssl ocsp) to distinguish a revoked cert from a responder-side problem.
2. Ensure the host running redis-py can reach the OCSP responder URL embedded in the certificate chain.
3. Verify ca_certs/ssl_ca_certs point to the correct CA bundle.
4. If the responder is temporarily down and your policy allows it, disable pure OCSP (ssl_validate_ocsp=False) or switch to stapled validation.

Example fix

# before
r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)
# after - verify with openssl first; if responder is just unreachable, use stapled
r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp_stapled=True)

# No purely local validation can prove OCSP validity, but you can preflight reachability
# of the responder URL from the cert chain before connecting:
# 1) fetch the cert with openssl s_client, 2) parse OCSP URI, 3) probe the responder.
# At minimum, ensure ca_certs resolve:
import os
assert os.path.exists(ca_certs_path), 'ca_certs file missing'

from redis.exceptions import ConnectionError
for attempt in range(3):
    try:
        r = redis.Redis.from_url('rediss://host', ssl_validate_ocsp=True)
        r.ping()
        break
    except ConnectionError as e:
        if 'ocsp validation error' in str(e):
            # investigate: revoked cert vs responder outage; do not blindly trust
            raise
        continue

When it happens

Trigger: Connecting with ssl_validate_ocsp=True against a server whose certificate has been revoked, whose OCSP responder is unreachable/misconfigured, or whose chain cannot be verified by OCSPVerifier.

Common situations: Certificate actually revoked. OCSP responder blocked by a firewall or behind a proxy. Stale/incorrect ca_certs passed to the verifier. Transient responder outage during deployment.

Related errors

• failed to fetch issuer certificate
• failed to fetch ocsp certificate
• delegate not authorized for ocsp signing
• failed to retrieve a successful response from the ocsp…
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/f4a11ba972cf29be. Report an issue: GitHub.

Appendix: source

Thrown at redis/connection.py:2262

            )

            #  need another socket
            con = OpenSSL.SSL.Connection(staple_ctx, socket.socket())
            con.request_ocsp()
            con.connect((self.host, self.port))
            con.do_handshake()
            con.shutdown()
            return sslsock

        # pure ocsp validation
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE:
            from .ocsp import OCSPVerifier

            o = OCSPVerifier(sslsock, self.host, self.port, self.ca_certs)
            if o.is_valid():
                return sslsock
            else:
                raise ConnectionError("ocsp validation error")
        return sslsock


class UnixDomainSocketConnection(AbstractConnection):
    "Manages UDS communication to and from a Redis server"

    def __init__(self, path="", socket_timeout=DEFAULT_SOCKET_TIMEOUT, **kwargs):
        super().__init__(**kwargs)
        self.path = path
        self.socket_timeout = socket_timeout

    def repr_pieces(self):
        pieces = [("path", self.path), ("db", self.db)]
        if self.client_name:
            pieces.append(("client_name", self.client_name))
        return pieces

    def _connect(self):

View on GitHub (pinned to 6a6b581b48)