SSL error when using Requests 2.8.1 and SHA-1

I'm trying to connect to a site which uses TLS 1.2 using reqests package in Python 3.5. In Chrome I get the warning that the certificate chain for the website contains atleast one certificate that was signed by using SHA-1.

I get the following error:

```
Traceback (most recent call last):

  File "<ipython-input-51-e43bc1030cea>", line 1, in <module>
    f = s.get(url)

  File "C:\Anaconda3\lib\site-packages\requests\sessions.py", line 480, in get
    return self.request('GET', url, **kwargs)

  File "C:\Anaconda3\lib\site-packages\requests\sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)

  File "C:\Anaconda3\lib\site-packages\requests\sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)

  File "C:\Anaconda3\lib\site-packages\requests\adapters.py", line 433, in send
    raise SSLError(e, request=request)

SSLError: EOF occurred in violation of protocol (_ssl.c:646)
```

Requests version is 2.8.1 and Python version is Python 3.5.0 :: Anaconda 2.4.0 (64-bit)

Is there a fix to this issue or has come across something similar? I have tried connecting to the site by forcing the TLS version after this [blog](https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/) form one of the contributors to Requests package, but I still get the sam error. Upgrading certs on the site is not an option now.


EOF in violation of protocol suggests that the remote peer has rejected the connection for some reason and, rather than terminate it cleanly, has decided to tear the connection down. Do you have PyOpenSSL installed?


But I'm able to hit the same server from a browser or PostMan. There's no authentication for the site too. 
No, I don't have PyOpenSSL let me try researching that.


@datarup No need. Can you run this from your Python shell?

``` python
import ssl
print ssl.OPENSSL_VERSION
```


OpenSSL 1.0.2d 9 Jul 2015


Alright, fab. Can you share the URL with me, either in this thread or privately? I'd like to see if I can verify the problem on my end.


I'm sorry, but he site is hosted on our intranet and you will not be able to hit externally.


In that case, do you feel comfortable sending me a packet capture from your machine as you attempt this connection? You'd need to use a tool like Wireshark to capture it.


Okay, I will PM you the capture.


@Lukasa The capture was not possible due to IT restrictions on Wireshark. Anyway I have tried curl and it works. the site has 'SSL connection using TLS_RSA_WITH_RC4_128_SHA'   and I tried the suggestion [on Stack Overflow](http://stackoverflow.com/questions/32650984/why-does-python-requests-ignore-the-verify-parameter) but still get the same error


Update: Running it as a prepared request in a session is working:

```
from requests import Request, Session
s = Session()
req = Request('GET', url)
prepped = req.prepare()
resp = s.send(prepped)
s.close()
```

I was using this, which has issues with EOF error:

```
import requests
requests.get(url)
```

Have I missed some documentation and the second approach was not quite right or should that too work?

Thanks!


These should be essentially identical. I wonder...when you use the prepared request, can you show me information about the response?


Respnse headers:

```
{'Content-Type': 'application/json;charset=UTF-8', 'ETag': '7db2c493cc7a80f2fc0fff9cea09e59a', 'Access-Control-Allow-Headers': 'origin, x-requested-with, content-type,gm-clientidentifier,gm-clientkey', 'Transfer-Encoding': 'chunked', 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'PUT, GET, POST, DELETE, OPTIONS', 'Date': 'Thu, 12 Nov 2015 19:30:31 GMT', 'X-Powered-By': 'Servlet/2.5 JSP/2.1'}
```

Status: 200 OK
Apparent-encoding: ascii
is_redirect: False
Content: {Is a valid json}

Let me know if you need any other information from response


So, the key reason the prepared request would be different is because you didn't give it a chance to merge your environment settings. Can you check for me, please, the following environment variables: `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`,


Here are the variables:

```
NO_PROXY: localhost,127.0.0.1,::1,[::1]
HTTP_PROXY: http://user:pass@proxy:port
HTTPS_PROXY: https://user:pass@proxy:port
```

Proxy is connection is valid. REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE are not present. 


Yeah, the proxy connection is valid, but requests doesn't support speaking to proxy using https. That's where your problem is coming from: we're not doing what that proxy wants us to do.

You can either change your HTTPS_PROXY variable to be "http://user:pass@proxy:port", or you can set proxies={'https': 'http://user:pass@proxy:port'} to enable requests to function correctly.