redis/redis-py · critical · RedisError

Python wasn't built with SSL support

Error message

Python wasn't built with SSL support

What it means

Raised in SSLConnection.__init__ when the module-level flag SSL_AVAILABLE is False, meaning Python's interpreter was compiled without the stdlib ssl module (import ssl failed). redis-py cannot construct a TLS connection without it because it relies on ssl.create_default_context and ssl.wrap_socket. This is a hard environment failure, not a runtime network problem.

Solutions

1. Reinstall or rebuild Python against OpenSSL so the ssl module imports (python -c 'import ssl' should succeed).
2. Switch to an official Python Docker image (python:3.x-slim includes ssl) instead of a from-scratch build.
3. On Alpine, install openssl/libssl and rebuild Python, or use a glibc-based image.
4. If TLS is not actually required, drop the rediss:// scheme / ssl=True and use a plain redis:// connection.

Example fix

# before - fails on a Python built without ssl
r = redis.Redis.from_url('rediss://host:6379')
# after - ensure ssl imports first, else fall back
import ssl as _ssl_test  # raises ImportError if absent
r = redis.Redis.from_url('rediss://host:6379')

try:
    import ssl  # noqa: F401
    ssl_ok = True
except ImportError:
    ssl_ok = False

if not ssl_ok:
    raise RuntimeError('Python ssl module unavailable; cannot use rediss:// or SSLConnection')

r = redis.Redis.from_url('rediss://host:6379')

import ssl

def ssl_available() -> bool:
    try:
        import ssl as _ssl  # noqa: F401
        return True
    except ImportError:
        return False

from redis.exceptions import RedisError
try:
    r = redis.Redis.from_url('rediss://host')
except RedisError as e:
    if 'SSL support' in str(e):
        raise SystemExit('Rebuild Python with OpenSSL, or use redis:// without TLS')
    raise

When it happens

Trigger: Constructing SSLConnection directly, calling redis.from_url('rediss://...'), or passing ssl=True / connection_class=SSLConnection on a Python build where the ssl C extension is absent.

Common situations: Custom-compiled CPython without OpenSSL headers linked (common in stripped Docker images or source builds without libssl-dev). Alpine Linux images missing libssl. Embedded Python distributions that exclude the ssl module. A rediss:// URL accidentally used against such an interpreter.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• cryptography is not installed.
• Either an OCSP staple or pure OCSP connection must be…
• Hiredis is not installed
• Invalid SSL Certificate Requirements Flag
• Invalid ssl verify flag

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/72183205c5581fcb. Report an issue: GitHub.

Appendix: source

Thrown at redis/connection.py:2134

            ssl_exclude_verify_flags: A list of flags to be excluded from the SSLContext.verify_flags. Defaults to None.
            ssl_ca_certs: The path to a file of concatenated CA certificates in PEM format. Defaults to None.
            ssl_ca_data: Either an ASCII string of one or more PEM-encoded certificates or a bytes-like object of DER-encoded certificates.
            ssl_check_hostname: If set, match the hostname during the SSL handshake. Defaults to True.
            ssl_ca_path: The path to a directory containing several CA certificates in PEM format. Defaults to None.
            ssl_password: Password for unlocking an encrypted private key. Defaults to None.

            ssl_validate_ocsp: If set, perform a full ocsp validation (i.e not a stapled verification)
            ssl_validate_ocsp_stapled: If set, perform a validation on a stapled ocsp response
            ssl_ocsp_context: A fully initialized OpenSSL.SSL.Context object to be used in verifying the ssl_ocsp_expected_cert
            ssl_ocsp_expected_cert: A PEM armoured string containing the expected certificate to be returned from the ocsp verification service.
            ssl_min_version: The lowest supported SSL version. It affects the supported SSL versions of the SSLContext. None leaves the default provided by ssl module.
            ssl_ciphers: A string listing the ciphers that are allowed to be used. Defaults to None, which means that the default ciphers are used. See https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers for more information.

        Raises:
            RedisError
        """  # noqa
        if not SSL_AVAILABLE:
            raise RedisError("Python wasn't built with SSL support")

        self.keyfile = ssl_keyfile
        self.certfile = ssl_certfile
        if ssl_cert_reqs is None:
            ssl_cert_reqs = ssl.CERT_NONE
        elif isinstance(ssl_cert_reqs, str):
            CERT_REQS = {  # noqa: N806
                "none": ssl.CERT_NONE,
                "optional": ssl.CERT_OPTIONAL,
                "required": ssl.CERT_REQUIRED,
            }
            if ssl_cert_reqs not in CERT_REQS:
                raise RedisError(
                    f"Invalid SSL Certificate Requirements Flag: {ssl_cert_reqs}"
                )
            ssl_cert_reqs = CERT_REQS[ssl_cert_reqs]
        self.cert_reqs = ssl_cert_reqs
        self.ssl_include_verify_flags = ssl_include_verify_flags

View on GitHub (pinned to 6a6b581b48)