requests and pylab SSL conflict

Installing pylab after requests makes requests fail SSL certificate verification. Wasn't sure if I should report this here or in pylab repo. This was tested with Docker.

$ ls
`Dockerfile  test.py
`
$ cat Dockerfile

```
FROM python:2.7
ADD test.py .
RUN apt-get install openssl libssl-dev
RUN pip install requests
CMD ["python","test.py"]
```

$ cat test.py

```
import requests
print requests.get("https://google.com")
```

$ sudo su
# docker build --tag bugtest1 . && docker run --rm bugtest1

```
Sending build context to Docker daemon 3.072 kB
Step 1 : FROM python:2.7
 ---> 8f7cafb9cc63
Step 2 : ADD test.py .
 ---> Using cache
 ---> c5e7e76e36c6
Step 3 : RUN apt-get install openssl libssl-dev
 ---> Using cache
 ---> cecc8e87d049
Step 4 : RUN pip install requests
 ---> Using cache
 ---> 6f309b214a07
Step 5 : CMD python test.py
 ---> Using cache
 ---> 161f61e62da3
Successfully built 161f61e62da3
<Response [200]>
```

# vim Dockerfile # add pylab line
# cat Dockerfile

```
FROM python:2.7
ADD test.py .
RUN apt-get install openssl libssl-dev
RUN pip install requests
RUN pip install pylab
CMD ["python","test.py"]

```

# docker build --tag bugtest1 . && docker run --rm bugtest1

```
Sending build context to Docker daemon 3.072 kB
Step 1 : FROM python:2.7
 ---> 8f7cafb9cc63
Step 2 : ADD test.py .
 ---> Using cache
 ---> c5e7e76e36c6
Step 3 : RUN apt-get install openssl libssl-dev
 ---> Using cache
 ---> cecc8e87d049
Step 4 : RUN pip install requests
 ---> Using cache
 ---> 6f309b214a07
Step 5 : RUN pip install pylab
 ---> Running in dc7af4eba40b
Collecting pylab
  Downloading pylab-0.1.3-py2.py3-none-any.whl
Collecting networkx (from pylab)
  Downloading networkx-1.11-py2.py3-none-any.whl (1.3MB)
Collecting pytz (from pylab)
  Downloading pytz-2016.4-py2.py3-none-any.whl (480kB)
Collecting tornado (from pylab)
  Downloading tornado-4.3.tar.gz (450kB)
Collecting pandas (from pylab)
  Downloading pandas-0.18.1.tar.gz (7.3MB)
Collecting seaborn (from pylab)
  Downloading seaborn-0.7.0.tar.gz (154kB)
Collecting numpy (from pylab)
  Downloading numpy-1.11.0-cp27-cp27mu-manylinux1_x86_64.whl (15.3MB)
Collecting matplotlib (from pylab)
  Downloading matplotlib-1.5.1.tar.gz (54.0MB)
Collecting jsonschema (from pylab)
  Downloading jsonschema-2.5.1-py2.py3-none-any.whl
Collecting scipy (from pylab)
  Downloading scipy-0.17.1-cp27-cp27mu-manylinux1_x86_64.whl (39.5MB)
Collecting jinja2 (from pylab)
  Downloading Jinja2-2.8-py2.py3-none-any.whl (263kB)
Collecting sympy (from pylab)
  Downloading sympy-1.0.tar.gz (4.3MB)
Collecting ipython (from pylab)
  Downloading ipython-4.2.0-py2-none-any.whl (736kB)
Collecting scikit-image (from pylab)
  Downloading scikit_image-0.12.3-cp27-cp27mu-manylinux1_x86_64.whl (28.0MB)
Collecting scikit-learn (from pylab)
  Downloading scikit_learn-0.17.1-cp27-cp27mu-manylinux1_x86_64.whl (17.6MB)
Collecting pyzmq (from pylab)
  Downloading pyzmq-15.2.0.zip (1.5MB)
Collecting decorator>=3.4.0 (from networkx->pylab)
  Downloading decorator-4.0.9-py2.py3-none-any.whl
Collecting backports.ssl-match-hostname (from tornado->pylab)
  Downloading backports.ssl_match_hostname-3.5.0.1.tar.gz
Collecting singledispatch (from tornado->pylab)
  Downloading singledispatch-3.4.0.3-py2.py3-none-any.whl
Collecting certifi (from tornado->pylab)
  Downloading certifi-2016.2.28-py2.py3-none-any.whl (366kB)
Collecting backports-abc>=0.4 (from tornado->pylab)
  Downloading backports_abc-0.4-py2.py3-none-any.whl
Collecting python-dateutil (from pandas->pylab)
  Downloading python_dateutil-2.5.3-py2.py3-none-any.whl (201kB)
Collecting cycler (from matplotlib->pylab)
  Downloading cycler-0.10.0-py2.py3-none-any.whl
Collecting pyparsing!=2.0.0,!=2.0.4,>=1.5.6 (from matplotlib->pylab)
  Downloading pyparsing-2.1.4-py2.py3-none-any.whl (40kB)
Collecting functools32 (from jsonschema->pylab)
  Downloading functools32-3.2.3-2.zip
Collecting MarkupSafe (from jinja2->pylab)
  Downloading MarkupSafe-0.23.tar.gz
Collecting mpmath>=0.19 (from sympy->pylab)
  Downloading mpmath-0.19.tar.gz (498kB)
Collecting traitlets (from ipython->pylab)
  Downloading traitlets-4.2.1-py2.py3-none-any.whl (67kB)
Collecting pickleshare (from ipython->pylab)
  Downloading pickleshare-0.7.2-py2.py3-none-any.whl
Collecting simplegeneric>0.8 (from ipython->pylab)
  Downloading simplegeneric-0.8.1.zip
Collecting backports.shutil-get-terminal-size (from ipython->pylab)
  Downloading backports.shutil_get_terminal_size-1.0.0-py2.py3-none-any.whl
Requirement already satisfied (use --upgrade to upgrade): setuptools>=18.5 in /usr/local/lib/python2.7/site-packages (from ipython->pylab)
Collecting pexpect (from ipython->pylab)
  Downloading pexpect-4.0.1.tar.gz (143kB)
Collecting dask[array]>=0.5.0 (from scikit-image->pylab)
  Downloading dask-0.9.0-py2.py3-none-any.whl (203kB)
Collecting six>=1.7.3 (from scikit-image->pylab)
  Downloading six-1.10.0-py2.py3-none-any.whl
Collecting pillow>=2.1.0 (from scikit-image->pylab)
  Downloading Pillow-3.2.0.zip (10.5MB)
Collecting ipython-genutils (from traitlets->ipython->pylab)
  Downloading ipython_genutils-0.1.0-py2.py3-none-any.whl
Collecting pathlib2 (from pickleshare->ipython->pylab)
  Downloading pathlib2-2.1.0-py2.py3-none-any.whl
Collecting ptyprocess>=0.5 (from pexpect->ipython->pylab)
  Downloading ptyprocess-0.5.1-py2.py3-none-any.whl
Collecting toolz>=0.7.2 (from dask[array]>=0.5.0->scikit-image->pylab)
  Downloading toolz-0.7.4.tar.gz
Building wheels for collected packages: tornado, pandas, seaborn, matplotlib, sympy, pyzmq, backports.ssl-match-hostname, functools32, MarkupSafe, mpmath, simplegeneric, pexpect, pillow, toolz
  Running setup.py bdist_wheel for tornado: started
  Running setup.py bdist_wheel for tornado: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/df/20/c7/38911d3d7ac9ae3c6c1b73f01bc61d8fdb46c7fad1a720d394
  Running setup.py bdist_wheel for pandas: started
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: still running...
  Running setup.py bdist_wheel for pandas: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/9a/8c/95/ceb8f988caf19dd90c4c587eea0ee1665c3bb6af73b3ca8264
  Running setup.py bdist_wheel for seaborn: started
  Running setup.py bdist_wheel for seaborn: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/e0/94/01/731d82dc437e1c8b65130956028f3fe693943c3e499a676dc9
  Running setup.py bdist_wheel for matplotlib: started
  Running setup.py bdist_wheel for matplotlib: still running...
  Running setup.py bdist_wheel for matplotlib: still running...
  Running setup.py bdist_wheel for matplotlib: still running...
  Running setup.py bdist_wheel for matplotlib: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/d8/38/3c/a388e11fd09f9b23f5e4cd74594197394d9fd65f91f64c4aa7
  Running setup.py bdist_wheel for sympy: started
  Running setup.py bdist_wheel for sympy: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/05/93/22/2d0f59d842347b1f38df0d3f7a3870586df60568d2a49d94c5
  Running setup.py bdist_wheel for pyzmq: started
  Running setup.py bdist_wheel for pyzmq: still running...
  Running setup.py bdist_wheel for pyzmq: still running...
  Running setup.py bdist_wheel for pyzmq: still running...
  Running setup.py bdist_wheel for pyzmq: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/a1/2f/b7/8d30910d93816f084b3d29ec38e38ae7cc9f8431a0b44a5864
  Running setup.py bdist_wheel for backports.ssl-match-hostname: started
  Running setup.py bdist_wheel for backports.ssl-match-hostname: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/5d/72/36/b2a31507b613967b728edc33378a5ff2ada0f62855b93c5ae1
  Running setup.py bdist_wheel for functools32: started
  Running setup.py bdist_wheel for functools32: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/3c/d0/09/cd78d0ff4d6cfecfbd730782a7815a4571cd2cd4d2ed6e69d9
  Running setup.py bdist_wheel for MarkupSafe: started
  Running setup.py bdist_wheel for MarkupSafe: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/a3/fa/dc/0198eed9ad95489b8a4f45d14dd5d2aee3f8984e46862c5748
  Running setup.py bdist_wheel for mpmath: started
  Running setup.py bdist_wheel for mpmath: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/02/2b/99/cd867d5da48d951118a8020e86c0c12a65022702426582d4b8
  Running setup.py bdist_wheel for simplegeneric: started
  Running setup.py bdist_wheel for simplegeneric: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/7b/31/08/c85e74c84188cbec6a6827beec4d640f2bd78ae003dc1ec09d
  Running setup.py bdist_wheel for pexpect: started
  Running setup.py bdist_wheel for pexpect: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/f2/65/89/09578bcd0efeabc7e2b0079cd62d3955c1477f2e55aa5031a4
  Running setup.py bdist_wheel for pillow: started
  Running setup.py bdist_wheel for pillow: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/88/2d/ce/3ff4ae4e2b8600d1bde1cbde5dfcc6d8770222c38348fe9139
  Running setup.py bdist_wheel for toolz: started
  Running setup.py bdist_wheel for toolz: finished with status 'done'
  Stored in directory: /root/.cache/pip/wheels/3e/e9/72/b9e24c6b4c0347670b9a20afeba6b2534655f5dc714b30cb4e
Successfully built tornado pandas seaborn matplotlib sympy pyzmq backports.ssl-match-hostname functools32 MarkupSafe mpmath simplegeneric pexpect pillow toolz
Installing collected packages: decorator, networkx, pytz, backports.ssl-match-hostname, six, singledispatch, certifi, backports-abc, tornado, python-dateutil, numpy, pandas, scipy, cycler, pyparsing, matplotlib, seaborn, functools32, jsonschema, MarkupSafe, jinja2, mpmath, sympy, ipython-genutils, traitlets, pathlib2, pickleshare, simplegeneric, backports.shutil-get-terminal-size, ptyprocess, pexpect, ipython, toolz, dask, pillow, scikit-image, scikit-learn, pyzmq, pylab
Successfully installed MarkupSafe-0.23 backports-abc-0.4 backports.shutil-get-terminal-size-1.0.0 backports.ssl-match-hostname-3.5.0.1 certifi-2016.2.28 cycler-0.10.0 dask-0.9.0 decorator-4.0.9 functools32-3.2.3.post2 ipython-4.2.0 ipython-genutils-0.1.0 jinja2-2.8 jsonschema-2.5.1 matplotlib-1.5.1 mpmath-0.19 networkx-1.11 numpy-1.11.0 pandas-0.18.1 pathlib2-2.1.0 pexpect-4.0.1 pickleshare-0.7.2 pillow-3.2.0 ptyprocess-0.5.1 pylab-0.1.3 pyparsing-2.1.4 python-dateutil-2.5.3 pytz-2016.4 pyzmq-15.2.0 scikit-image-0.12.3 scikit-learn-0.17.1 scipy-0.17.1 seaborn-0.7.0 simplegeneric-0.8.1 singledispatch-3.4.0.3 six-1.10.0 sympy-1.0 toolz-0.7.4 tornado-4.3 traitlets-4.2.1
You are using pip version 8.1.1, however version 8.1.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
 ---> 3b53dc9ef60f
Removing intermediate container dc7af4eba40b
Step 6 : CMD python test.py
 ---> Running in 243dd6bfbc15
 ---> c977d7831c40
Removing intermediate container 243dd6bfbc15
Successfully built c977d7831c40
Traceback (most recent call last):
  File "test.py", line 2, in <module>
    print requests.get("https://google.com")
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 71, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 57, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 475, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 585, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 477, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)

```

# docker exec -ti containername bash
root(inside docker container):/# python --version

```
Python 2.7.11
```

root(inside docker container):/# pip show requests

```

---
Metadata-Version: 2.0
Name: requests
Version: 2.10.0
Summary: Python HTTP for Humans.
Home-page: http://python-requests.org
Author: Kenneth Reitz
Author-email: me@kennethreitz.com
Installer: pip
License: Apache 2.0
Location: /usr/local/lib/python2.7/site-packages
Requires:
Classifiers:
  Development Status :: 5 - Production/Stable
  Intended Audience :: Developers
  Natural Language :: English
  License :: OSI Approved :: Apache Software License
  Programming Language :: Python
  Programming Language :: Python :: 2.6
  Programming Language :: Python :: 2.7
  Programming Language :: Python :: 3
  Programming Language :: Python :: 3.3
  Programming Language :: Python :: 3.4
  Programming Language :: Python :: 3.5
  Programming Language :: Python :: Implementation :: CPython
  Programming Language :: Python :: Implementation :: PyPy
You are using pip version 8.1.1, however version 8.1.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
```

root(inside docker container):/# pip show pylab

```

---
Metadata-Version: 2.0
Name: pylab
Version: 0.1.3
Summary: Data science meta-package
Home-page: https://github.com/javipalanca/pylab
Author: Javi Palanca
Author-email: jpalanca@gmail.com
Installer: pip
License: BSD
Location: /usr/local/lib/python2.7/site-packages
Requires: networkx, pytz, tornado, pandas, seaborn, numpy, matplotlib, jsonschema, scipy, jinja2, sympy, ipython, scikit-image, scikit-learn, pyzmq
Classifiers:
  Development Status :: 2 - Pre-Alpha
  Intended Audience :: Developers
  License :: OSI Approved :: BSD License
  Natural Language :: English
  Programming Language :: Python :: 2
  Programming Language :: Python :: 2.6
  Programming Language :: Python :: 2.7
  Programming Language :: Python :: 3
  Programming Language :: Python :: 3.3
  Programming Language :: Python :: 3.4
You are using pip version 8.1.1, however version 8.1.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
```


Can you please show us what version of openssl is linked against Python in your container? `python -c "import ssl; print ssl.OPENSSL_VERSION"` should do the trick.


both setups (installing pylab+requests or only requests), print the same openssl version:
OpenSSL 1.0.1k 8 Jan 2015


Yup, so the problem here is that pylab brings in certifi. Certifi has removed the deprecated and weak 1024-bit trust roots that requests normally ships with, but requests will use it if available. That's fine except that OpenSSL earlier than 1.0.2 will fail to build the cert chain if the site uses a cross-signed root cert. 

Try setting the environment variable `REQUESTS_CA_BUNDLE` to the string returned by `python -c "import certifi; print certifi.old_where"` and see if that helps. 


Thanks! That fixed the issue.

```
ENV REQUESTS_CA_BUNDLE "/usr/local/lib/python2.7/site-packages/certifi/weak.pem"
```