Skip to content

Commit 3cdb406

Browse files
committed
Backwards Incompatible note about ssl_cert_reqs change
See #1017
1 parent dcb135c commit 3cdb406

File tree

1 file changed

+17
-0
lines changed

1 file changed

+17
-0
lines changed

README.rst

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,23 @@ use any of the following commands:
9999
not exist)
100100

101101

102+
SSL Connections
103+
^^^^^^^^^^^^^^^
104+
105+
redis-py 3.0 changes the default value of the `ssl_cert_reqs` option from
106+
`None` to `'required'`. See
107+
`Issue 1016 <https://github.com/andymccurdy/redis-py/issues/1016>`_. This
108+
change enforces hostname validation when accepting a cert from a remote SSL
109+
terminator. If the terminator doesn't properly set the hostname on the cert
110+
this will cause redis-py 3.0 to raise a ConnectionError.
111+
112+
This check can be disabled by setting `ssl_cert_reqs` to `None`. Note that
113+
doing so removes the security check. Do so at your own risk.
114+
115+
It has been reported that SSL certs received from AWS ElastiCache do not have
116+
proper hostnames and turning off hostname verification is currently required.
117+
118+
102119
MSET, MSETNX and ZADD
103120
^^^^^^^^^^^^^^^^^^^^^
104121

0 commit comments

Comments
 (0)