Asking for an option to deactivate x509 strict mode for TLS connections

[devl00p]

Hello,

We are using Google Cloud for our python jobs using Redis. When we tried to upgrade some of our code to Python 3.13 we noticed that our jobs could not access our hosted Redis instance.

This is related to the Python 3.13 change: https://docs.python.org/3/whatsnew/3.13.html#ssl

The VERIFY_X509_STRICT is now used by default by Python 3.13 and unfortunately the certificates generated by the cloud provider don't have that TLS x509 extension.

Currently:

• I can't recreate the server certificate which is handled by the cloud provider
• I can't find a parameter on the redis-py client to deactivate the x509 strict mode
• I'm stuck with Python 3.12

One solution would be to completely deactivate the certificate checking but this is something we can't do for security purpose.

Would it be possible to have a way to deactivate x509 strict mode inside Redis-py ?

I looked at existing parameters and didn't see something helpful.

The error message we get:

redis.exceptions.ConnectionError: Error 1 connecting to redis-production:6378. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028).

Best regards

[petyaslavova]

Hi @devl00p,
You're absolutely right — at the moment, it's not possible to configure verify_flags for the client's SSL context. I’ll try to add support for this in the coming weeks, but I can’t guarantee exactly when I’ll be able to implement and merge it. If you have some time, feel free to open a PR adding it as a configurable option when creating the client — that would be very welcome!