redis/redis-py · error · AuthorizationError

you are not authorized to view this ocsp certificate

Error message

you are not authorized to view this ocsp certificate

What it means

Raised as an AuthorizationError (redis.exceptions, not ConnectionError) by _check_certificate (redis/ocsp.py:56) when ocsp_response.response_status equals OCSPResponseStatus.UNAUTHORIZED. The OCSP responder refused to give a status for the requested certificate — the requester is not permitted to query status for that cert/serial. Notably OCSPVerifier.is_valid() catches AuthorizationError and retries via a direct connection, so end users normally only see this if the direct retry also fails or if the staple verifier path hit it.

Solutions

1. Confirm the OCSP responder URL is the correct one for the certificate's CA and that the client is authorized to query it.
2. If the responder requires mutual TLS or a bearer token, configure the HTTP client used for OCSP fetch accordingly.
3. For stapled responses, ensure the server is configured to staple an authorized response; an UNAUTHORIZED staple means the server itself was refused by the responder.
4. If authorization cannot be granted, disable OCSP for this endpoint only after a deliberate risk decision, or switch to CRL-based revocation checks.

Example fix

# before - responder refuses the query
verifier = OCSPVerifier(sock, host, port)
verifier.is_valid()  # AuthorizationError on both staple and direct retry

# after - confirm responder URL matches cert AIA, ensure authorization
# (configure OCSP responder to permit the client, or use an authorized responder)

from cryptography.x509 import ocsp

def responder_authorized(ocsp_bytes):
    resp = ocsp.load_der_ocsp_response(ocsp_bytes)
    return resp.response_status != ocsp.OCSPResponseStatus.UNAUTHORIZED

from redis.exceptions import AuthorizationError

try:
    verifier.is_valid()
except AuthorizationError as e:
    logging.warning('OCSP responder refused the request: %s', e)
    # configure the client to be authorized by the responder, or use an alternate responder
    raise

When it happens

Trigger: OCSP stapling path: ocsp_staple_verifier receives a stapled response whose status is UNAUTHORIZED. Direct path: check_certificate fetches a responder URL that returns UNAUTHORIZED, and either is_valid()'s direct-connection retry also returns UNAUTHORIZED, or you call check_certificate directly.

Common situations: The responder requires client authentication/authorization the client does not have; querying status for a certificate issued under a different CA/account; the OCSP responder is configured with an allowlist that excludes the requesting client; private/internal CA deployments where OCSP access is restricted.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• delegate not authorized for ocsp signing
• failed to fetch issuer certificate
• failed to fetch ocsp certificate
• failed to retrieve a successful response from the ocsp…
• failed to valid ocsp response

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/0cfba77a99db8160. Report an issue: GitHub.

Appendix: source

Thrown at redis/ocsp.py:56

        elif isinstance(pubkey, EllipticCurvePublicKey):
            pubkey.verify(
                ocsp_response.signature,
                ocsp_response.tbs_response_bytes,
                ECDSA(ocsp_response.signature_hash_algorithm),
            )
        else:
            pubkey.verify(ocsp_response.signature, ocsp_response.tbs_response_bytes)
    except InvalidSignature:
        raise ConnectionError("failed to valid ocsp response")


def _check_certificate(issuer_cert, ocsp_bytes, validate=True):
    """A wrapper the return the validity of a known ocsp certificate"""

    ocsp_response = ocsp.load_der_ocsp_response(ocsp_bytes)

    if ocsp_response.response_status == ocsp.OCSPResponseStatus.UNAUTHORIZED:
        raise AuthorizationError("you are not authorized to view this ocsp certificate")
    if ocsp_response.response_status == ocsp.OCSPResponseStatus.SUCCESSFUL:
        if ocsp_response.certificate_status != ocsp.OCSPCertStatus.GOOD:
            raise ConnectionError(
                f"Received an {str(ocsp_response.certificate_status).split('.')[1]} "
                "ocsp certificate status"
            )
    else:
        raise ConnectionError(
            "failed to retrieve a successful response from the ocsp responder"
        )

    if ocsp_response.this_update >= datetime.datetime.now():
        raise ConnectionError("ocsp certificate was issued in the future")

    if (
        ocsp_response.next_update
        and ocsp_response.next_update < datetime.datetime.now()
    ):

View on GitHub (pinned to 6a6b581b48)