redis/redis-py · critical · ConnectionError

Received an ocsp certificate status

Error message

Received an {str(ocsp_response.certificate_status).split('.')[1]} ocsp certificate status

What it means

Raised as a ConnectionError by _check_certificate (redis/ocsp.py:59) when the OCSP response_status is SUCCESSFUL but certificate_status is not GOOD — i.e. REVOKED or UNKNOWN. The f-string extracts the lowercase status name by splitting the enum's str representation on '.' (so OCSPCertStatus.REVOKED becomes 'revoked'), producing messages like 'Received an revoked ocsp certificate status'. A non-GOOD status means the certificate is either provably revoked or its status cannot be determined.

Solutions

If REVOKED: rotate the client/server certificate immediately — a revoked certificate must not be used; this is a security event.
If UNKNOWN: retry to rule out a transient responder issue; persistent UNKNOWN means the responder lacks coverage for this cert and you should use a covered responder or CRL.
Verify the certificate serial/subject matches an active, non-revoked certificate in your PKI.
Update the configured CA certs and confirm the OCSP responder authoritative for the issuing CA is the one being queried.

Example fix

# before - OCSP says revoked, connection blocked
verifier.is_valid()  # ConnectionError: Received an revoked ocsp certificate status

# after - rotate the certificate to a valid, non-revoked one
# 1. Issue a new certificate from the CA
# 2. Deploy new cert/key to the server
# 3. Point the client at the updated endpoint and re-enable OCSP

Defensive patterns

Strategy: try-catch

Validate before calling

from cryptography.x509 import ocsp

def certificate_status_is_good(ocsp_bytes):
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    return (
        resp.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL
        and resp.certificate_status == ocsp.OCSPCertStatus.GOOD
    )

Try / catch

from redis.exceptions import ConnectionError as RedisConnectionError

try:
    verifier.is_valid()
except RedisConnectionError as e:
    msg = str(e)
    if 'revoked' in msg:
        logging.critical('Certificate is REVOKED - rotate immediately: %s', e)
        raise
    if 'unknown' in msg:
        logging.warning('OCSP status UNKNOWN - retry or use alternate responder: %s', e)
    raise

Prevention

Track certificate expiration and rotation proactively so you never rely on a revoked cert.
For UNKNOWN statuses, retry and have an alternate OCSP responder or CRL configured.
Alert on REVOKED status as a security incident.
Keep CA and responder coverage aligned with the certificates you issue.

When it happens

Trigger: OCSP verification completes and the responder returns SUCCESSFUL/REVOKED (certificate has been revoked) or SUCCESSFUL/UNKNOWN (responder has no information). Either case is treated as a connection-blocking condition.

Common situations: Certificate revoked due to compromise or rotation but the client still references it; a stale cached cert after key rotation; responder returns UNKNOWN because it has no record for that serial (misconfigured responder, or cert from a different hierarchy); intermediate CA issue causing transient UNKNOWN responses.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/a149004607dd8801. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:59

                ocsp_response.tbs_response_bytes,
                ECDSA(ocsp_response.signature_hash_algorithm),
            )
        else:
            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)
    except InvalidSignature:
        raise ConnectionError("failed to valid ocsp response")


def _check_certificate(issuer_cert, ocsp_bytes, validate=True):
    """A wrapper the return the validity of a known ocsp certificate"""

    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)

    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:
        raise AuthorizationError("you are not authorized to view this ocsp certificate")
    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:
        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:
            raise ConnectionError(
                f"Received an {str(ocsp_response.certificate_status).split('.')[1]} "
                "ocsp certificate status"
            )
    else:
        raise ConnectionError(
            "failed to retrieve a successful response from the ocsp responder"
        )

    if ocsp_response.this_update >= datetime.datetime.now():
        raise ConnectionError("ocsp certificate was issued in the future")

    if (
        ocsp_response.next_update
        and ocsp_response.next_update < datetime.datetime.now()
    ):
        raise ConnectionError("ocsp certificate has invalid update - in the past")

    responder_name = ocsp_response.responder_name

View on GitHub (pinned to 6a6b581b48)