What causes "ocsp validation error" in redis/redis-py?

Inspect the actual certificate and OCSP responder status directly: `openssl ocsp -issuer chain.pem -cert server.pem -url -resp_text` to see the real revocation/validity reason.

redis/redis-py · error · ConnectionError

ocsp validation error

Error message

ocsp validation error

What it means

Raised in SSLConnection._wrap_socket_with_ssl (connection.py:2246) as a ConnectionError when pure OCSP validation is enabled (ssl_validate_ocsp=True, cryptography available) and OCSPVerifier.is_valid() returns False. This means the OCSP responder reported the server certificate as revoked, expired, or otherwise invalid, or the OCSP response itself failed to verify.

Source

Thrown at redis/connection.py:2246

            )

            #  need another socket
            con = OpenSSL.SSL.Connection(staple_ctx, socket.socket())
            con.request_ocsp()
            con.connect((self.host, self.port))
            con.do_handshake()
            con.shutdown()
            return sslsock

        # pure ocsp validation
        if self.ssl_validate_ocsp is True and CRYPTOGRAPHY_AVAILABLE:
            from .ocsp import OCSPVerifier

            o = OCSPVerifier(sslsock, self.host, self.port, self.ca_certs)
            if o.is_valid():
                return sslsock
            else:
                raise ConnectionError("ocsp validation error")
        return sslsock


class UnixDomainSocketConnection(AbstractConnection):
    "Manages UDS communication to and from a Redis server"

    def __init__(self, path="", socket_timeout=DEFAULT_SOCKET_TIMEOUT, **kwargs):
        super().__init__(**kwargs)
        self.path = path
        self.socket_timeout = socket_timeout

    def repr_pieces(self):
        pieces = [("path", self.path), ("db", self.db)]
        if self.client_name:
            pieces.append(("client_name", self.client_name))
        return pieces

    def _connect(self):

View on GitHub (pinned to da03cdc7e8)

Solutions

Inspect the actual certificate and OCSP responder status directly: `openssl ocsp -issuer chain.pem -cert server.pem -url <ocsp-url> -resp_text` to see the real revocation/validity reason.
Verify the client clock is correct (NTP sync) — OCSP validity windows are time-sensitive.
Confirm the CA bundle used (ssl_ca_certs / system trust) matches the issuer chain of the server cert.
If the cert is legitimately revoked, rotate/reissue the server certificate; do not simply disable OCSP checks in production.
Temporarily set ssl_validate_ocsp=False only for diagnosis if you have independent confirmation the responder is at fault.

Example fix

# before
client = redis.Redis.from_url("rediss://h", ssl_validate_ocsp=True)
client.get("k")  # raises ConnectionError: ocsp validation error

# diagnose first
# openssl ocsp -issuer chain.pem -cert server.pem -url "$OCSP_URL" -resp_text

# after (cert reissued by ops, same config now succeeds)
client = redis.Redis.from_url("rediss://h", ssl_validate_ocsp=True)

Defensive patterns

Strategy: try-catch

Try / catch

from redis.exceptions import ConnectionError
from redis.backoff import ExponentialBackoff
from redis.retry import Retry

retry = Retry(ExponentialBackoff(), 3)
attempts = 0
while True:
    try:
        client = redis.Redis.from_url(url, ssl_validate_ocsp=True, retry=retry)
        client.ping()
        break
    except ConnectionError as e:
        if "ocsp validation error" in str(e):
            attempts += 1
            if attempts > 3:
                raise  # genuine revocation/responder problem — surface it
            continue
        raise

Prevention

Monitor certificate expiry and OCSP responder health independently of the client.
Keep client clocks NTP-synced to avoid false OCSP failures.
Treat persistent OCSP errors as a security signal (possible revocation) before disabling checks.
Validate the CA bundle matches the server's issuer chain.

When it happens

Trigger: First connection to a rediss:// host with ssl_validate_ocsp=True where the server cert is genuinely revoked/suspended, the OCSP responder is serving a bad signature, the chain cannot be built, or the OCSP response is stale. OCSPVerifier.is_valid() returning False produces this.

Common situations: Server certificate rotated/revoked by ops; intermediate CA change breaking OCSP chain validation; clock skew on the client causing 'not yet valid'/'expired' OCSP verdicts; misconfigured OCSP responder; transient responder outage returning a malformed response.

Related errors

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/f4a11ba972cf29be.json. Report an issue: GitHub.