The Fix
pip install redis==7.1.0
Based on closed redis/redis-py issue #3340 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -729,11 +729,24 @@ def __init__(self, ssl_keyfile=None, ssl_certfile=None,
"Wrap the socket with SSL support"
sock = super(SSLConnection, self)._connect()
- sock = ssl.wrap_socket(sock,
- cert_reqs=self.cert_reqs,
- keyfile=self.keyfile,
Option A — Upgrade to fixed release\npip install redis==7.1.0\nWhen NOT to use: This fix should not be used if SNI is not required for your Redis connections.\n\n
Why This Fix Works in Production
- Trigger: So my goal would be to establish with `redis-py` a Redis connection with SSL providing the `Server Name Identification`.
- Mechanism: The SSL connection did not support Server Name Indication (SNI) for multiple Redis instances
- Why the fix works: Adds support for SNI (Server Name Indication) connections to redis-py, allowing multiple Redis instances to be proxied with Traefik. (first fixed release: 7.1.0).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- The SSL connection did not support Server Name Indication (SNI) for multiple Redis instances
- Production symptom (often without a traceback): So my goal would be to establish with `redis-py` a Redis connection with SSL providing the `Server Name Identification`.
Proof / Evidence
- GitHub issue: #3340
- Fix PR: https://github.com/redis/redis-py/pull/1087
- First fixed release: 7.1.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.66
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“So redis-py actually use pyopenssl (not Python ssl stdlib module). Seems I need to call OpenSSL.SSL.Connection.set_tlsext_host_name(name). **Edit**: it uses both.”
“Just found that: https://github.com/redis/redis-py/pull/1087”
“In redis/connection.py:SSLConnection._wrap_socket_with_ssl: - sslsock = context.wrap_socket(sock, server_hostname=self.host) - then con.connect((self.host, self.port)) I would have expected the SNI passed in wrap_socket to be possibly different of…”
“This issue has been automatically marked as stale due to inactivity. It will be closed in 30 days if no further activity occurs. If you…”
Failure Signature (Search String)
- So my goal would be to establish with `redis-py` a Redis connection with SSL providing the `Server Name Identification`.
- This seems to be possible with [ssl.SSLContext.wrap_socket](https://docs.python.org/3.9/library/ssl.html#ssl.SSLContext.wrap_socket):
Copy-friendly signature
Failure Signature
-----------------
So my goal would be to establish with `redis-py` a Redis connection with SSL providing the `Server Name Identification`.
This seems to be possible with [ssl.SSLContext.wrap_socket](https://docs.python.org/3.9/library/ssl.html#ssl.SSLContext.wrap_socket):
Error Message
Signature-only (no traceback captured)
Error Message
-------------
So my goal would be to establish with `redis-py` a Redis connection with SSL providing the `Server Name Identification`.
This seems to be possible with [ssl.SSLContext.wrap_socket](https://docs.python.org/3.9/library/ssl.html#ssl.SSLContext.wrap_socket):
What Broke
Users experienced connection issues when routing multiple Redis instances through Traefik.
Why It Broke
The SSL connection did not support Server Name Indication (SNI) for multiple Redis instances
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install redis==7.1.0
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/redis/redis-py/pull/1087
First fixed release: 7.1.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix should not be used if SNI is not required for your Redis connections.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 7.1.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.