redis/redis-py · critical · RedisError

Python wasn't built with SSL support

Error message

Python wasn't built with SSL support

What it means

Raised as RedisError at the very top of SSLConnection.__init__ when the module-level SSL_AVAILABLE flag is False, i.e. this Python interpreter was compiled without the ssl module. The constructor fails before any socket is opened, so no async work has happened. This is an environment/build defect, not a runtime network issue.

Solutions

1. Use a CPython distribution built with OpenSSL (official python:3.x images, or rebuild with libssl-dev/openssl-devel installed).
2. In a container, switch from a minimal base to python:3.x-slim or python:3.x which bundle SSL.
3. If you cannot rebuild, use a non-SSL redis:// connection (only acceptable if transport is otherwise secured).
4. Verify with: python -c 'import ssl; print(ssl.OPENSSL_VERSION)'.

Example fix

// before (custom python built without ssl)
r = redis.asyncio.from_url('rediss://host:6379')
// after
# use python:3.12-slim base image, then:
r = redis.asyncio.from_url('rediss://host:6379')

import ssl

def assert_ssl_available() -> None:
    if not ssl.HAS_SSL:
        raise RuntimeError('Python interpreter has no SSL support; use a build with OpenSSL')

from redis.exceptions import RedisError

def is_no_ssl(exc: BaseException) -> bool:
    return isinstance(exc, RedisError) and 'SSL support' in str(exc)

from redis.exceptions import RedisError

try:
    r = redis.asyncio.from_url('rediss://host')
except RedisError as e:
    if 'SSL support' in str(e):
        raise RuntimeError('Rebuild Python with OpenSSL or use redis:// (non-TLS)') from e
    raise

When it happens

Trigger: Instantiating redis.asyncio.Redis.from_url('rediss://...') or SSLConnection(...) (or any path that selects connection_class=SSLConnection) on a Python built without OpenSSL linkage (some minimal Docker images, custom-compiled pyenv builds, or Alpine without openssl-dev at build time).

Common situations: Custom/SLIM Python base image missing libssl; python built with --disable-ssl or a broken OpenSSL detect; python3-minimal packages; conda/pyenv builds on systems lacking openssl-dev headers at compile time.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid SSL Certificate Requirements Flag
• Invalid ssl verify flag
• Cannot disable maintenance notifications after enabling them
• Cannot extend a lock with no timeout
• Cannot reacquire a lock with no timeout

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/84aa1fa270742847. Report an issue: GitHub.

Appendix: source

Thrown at redis/asyncio/connection.py:1535

    def __init__(
        self,
        ssl_keyfile: Optional[str] = None,
        ssl_certfile: Optional[str] = None,
        ssl_cert_reqs: Union[str, ssl.VerifyMode] = "required",
        ssl_include_verify_flags: Optional[List["ssl.VerifyFlags"]] = None,
        ssl_exclude_verify_flags: Optional[List["ssl.VerifyFlags"]] = None,
        ssl_ca_certs: Optional[str] = None,
        ssl_ca_data: Optional[str] = None,
        ssl_ca_path: Optional[str] = None,
        ssl_check_hostname: bool = True,
        ssl_min_version: Optional[TLSVersion] = None,
        ssl_ciphers: Optional[str] = None,
        ssl_password: Optional[str] = None,
        **kwargs,
    ):
        if not SSL_AVAILABLE:
            raise RedisError("Python wasn't built with SSL support")

        self.ssl_context: RedisSSLContext = RedisSSLContext(
            keyfile=ssl_keyfile,
            certfile=ssl_certfile,
            cert_reqs=ssl_cert_reqs,
            include_verify_flags=ssl_include_verify_flags,
            exclude_verify_flags=ssl_exclude_verify_flags,
            ca_certs=ssl_ca_certs,
            ca_data=ssl_ca_data,
            ca_path=ssl_ca_path,
            check_hostname=ssl_check_hostname,
            min_version=ssl_min_version,
            ciphers=ssl_ciphers,
            password=ssl_password,
        )
        super().__init__(**kwargs)

    def _connection_arguments(self) -> Mapping:

View on GitHub (pinned to 6a6b581b48)