SSL Wildcard Cert Issue

Hello, 

I am trying to open https://ia600301.us.archive.org/ with `requests` and i am receiving an `SSLError`

```
>>> import requests
>>> requests.get("https://ia600301.us.archive.org/")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 55, in get
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 44, in request
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 335, in request
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 438, in send
  File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 331, in send
requests.exceptions.SSLError: hostname 'ia600301.us.archive.org' doesn't match either of '*.archive.org', 'archive.org'
>>> requests.__version__
'1.2.3'
>>>

>>> import requests
>>> requests.get("https://ia600301.us.archive.org/")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/requests-2.0.1-py2.7.egg/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.0.1-py2.7.egg/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.0.1-py2.7.egg/requests/sessions.py", line 361, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.0.1-py2.7.egg/requests/sessions.py", line 464, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.0.1-py2.7.egg/requests/adapters.py", line 363, in send
    raise SSLError(e)
requests.exceptions.SSLError: hostname 'ia600301.us.archive.org' doesn't match either of '*.archive.org', 'archive.org'
>>> requests.__version__
'2.0.1'

>>> import requests
>>> requests.get("https://ia600301.us.archive.org/")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/requests-2.2.1-py2.7.egg/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.2.1-py2.7.egg/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.2.1-py2.7.egg/requests/sessions.py", line 383, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.2.1-py2.7.egg/requests/sessions.py", line 486, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests-2.2.1-py2.7.egg/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: hostname 'ia600301.us.archive.org' doesn't match either of '*.archive.org', 'archive.org'
>>> requests.__version__
'2.2.1'
```

The same Cert doesn't compain on my browser, also it looks ok here http://www.sslshopper.com/ssl-checker.html#hostname=https://ia600301.us.archive.org/


Afaik wildcards are not supposed to be recursive.
I don't have time right now, but I'll write a proper answer later.


@t-8ch @athoik 

wildcard certs support only one level wildcard-ish. 

But: The SSL certificate on hostname `ia600301.us.archive.org` is issued on the name `*.us.archive.org`. 

The error-message in requests shows another domain name .. 


@syphar, that is correct! Certificate has `Common name: *.us.archive.org` but in logs there is `hostname 'ia600301.us.archive.org' doesn't match either of '*.archive.org', 'archive.org'`


This is an SNI bug: Python 2.7 does not support SNI in the standard library at this time. You can get requests support for it by installing `pyopenssl`, `ndg-httpsclient` and `pyasn1` in addition to requests.

If you do that, you'll then find that the server doesn't support the handshake. I was unable to get this to work at all in my copy of requests, even when using the [SSLAdapter](http://toolbelt.readthedocs.org/en/latest/user.html#ssladapter) to force a protocol version. (Note that you need to use PyOpenSSL version specifiers when using the SSLAdapter in this situation.)

Sadly, at this time you're limited by the support of SSL in Python 2.7, which is _very bad_. My recommendation is to upgrade to Python 3, and hope that PEP 466 gets accepted to improve the SSL situation in Python 2.7.


Thanks for the explanation @Lukasa, lets hope that PEP 466 will accepted in Python 2.7. Until then i am afraid that setting `verify=False` is the only way.


You could also verify the certificate fingerprint(s), if this is feasable for your usecase.
You would need a custom transport adapter and the `assert_fingerprint` parameter to urllib3