Skip to content
Back to top
View this page
Edit this page

# SSL Connection Examples

## Connecting to a Valkey instance via SSL

    [ ]:

    import valkey

    r = valkey.Valkey(
        host='localhost',
        port=6666,
        ssl=True,
        ssl_cert_reqs="none",
    )
    r.ping()

    True

## Connecting to a Valkey instance via a URL string

    [ ]:

    import valkey

    r = valkey.from_url("valkeys://localhost:6666?ssl_cert_reqs=none&decode_responses=True&health_check_interval=2")
    r.ping()

    True

## Connecting to a Valkey instance using a ConnectionPool

    [ ]:

    import valkey

    valkey_pool = valkey.ConnectionPool(
        host="localhost",
        port=6666,
        connection_class=valkey.SSLConnection,
        ssl_cert_reqs="none",
    )

    r = valkey.StrictValkey(connection_pool=valkey_pool)
    r.ping()

    True

## Connecting to a Valkey instance via SSL, while specifying a minimum TLS version

    [ ]:

    import valkey
    import ssl

    r = valkey.Valkey(
        host="localhost",
        port=6666,
        ssl=True,
        ssl_min_version=ssl.TLSVersion.TLSv1_3,
        ssl_cert_reqs="none",
    )
    r.ping()

    True

## Connecting to a Valkey instance via SSL, while specifying a self-signed SSL CA certificate

    [ ]:

    import os
    import valkey

    pki_dir = os.path.join("..", "..", "dockers", "stunnel", "keys")

    r = valkey.Valkey(
        host="localhost",
        port=6666,
        ssl=True,
        ssl_certfile=os.path.join(pki_dir, "client-cert.pem"),
        ssl_keyfile=os.path.join(pki_dir, "client-key.pem"),
        ssl_cert_reqs="required",
        ssl_ca_certs=os.path.join(pki_dir, "ca-cert.pem"),
    )
    r.ping()

    True

## Connecting to a Valkey instance via SSL, and validate the OCSP status of the certificate

The valkey package is designed to be small, meaning extra libraries must be installed, in order to support OCSP stapling. As a result, first install valkey via:

`pip install valkey[ocsp]`

This will install cryptography, requests, and PyOpenSSL, none of which are generally required to use Valkey.

In the next example, we will connect to a Valkey instance via SSL, and validate the OCSP status of the certificate. However, the certificate we are using does not have an AIA extension, which means that the OCSP validation cannot be performed.

    [ ]:

    import os
    import valkey

    pki_dir = os.path.join("..", "..", "dockers", "stunnel", "keys")

    r = valkey.Valkey(
        host="localhost",
        port=6666,
        ssl=True,
        ssl_certfile=os.path.join(pki_dir, "client-cert.pem"),
        ssl_keyfile=os.path.join(pki_dir, "client-key.pem"),
        ssl_cert_reqs="required",
        ssl_ca_certs=os.path.join(pki_dir, "ca-cert.pem"),
        ssl_validate_ocsp=True,
    )

    try:
        r.ping()
    except valkey.ConnectionError as e:
        assert e.args[0] == "No AIA information present in ssl certificate"
        print("OCSP validation failed as expected.")

    OCSP validation failed as expected.

## Connect to a Valkey instance via SSL, and validate OCSP-stapled certificates

It is also possible to validate an OCSP stapled response. Again, for this example the server does not send an OCSP stapled response, so the validation will fail.

    [ ]:

    import os
    import valkey

    pki_dir = os.path.join("..", "..", "dockers", "stunnel", "keys")
    ca_cert = os.path.join(pki_dir, "ca-cert.pem")

    # It is possible to specify an expected certificate, or leave it out.
    expected_certificate = open(ca_cert, 'rb').read()

    # If needed, a custom SSL context for OCSP can be specified via ssl_ocsp_context

    r = valkey.Valkey(
        host="localhost",
        port=6666,
        ssl=True,
        ssl_certfile=os.path.join(pki_dir, "client-cert.pem"),
        ssl_keyfile=os.path.join(pki_dir, "client-key.pem"),
        ssl_cert_reqs="required",
        ssl_ca_certs=ca_cert,
        ssl_validate_ocsp_stapled=True,
        ssl_ocsp_expected_cert=expected_certificate,
    )

    try:
        r.ping()
    except valkey.ConnectionError as e:
        assert e.args[0] == "no ocsp response present"
        print("OCSP validation failed as expected.")

    OCSP validation failed as expected.