urllib3 v1.26.7 break Session Object with Proxy

The urllib3 library has released `1.26.7` and the changes have caused some additional issues with proxies and SSL certificates.

#### Version with issue

requests (latest)
urllib3 - 1.26.7 (latest)

#### Problem

Any port forwarding proxy breaks with code change.

#### Code to Reproduce

To reproduce:
1. Open fiddler
2. Run the following
```python
import requests
s = requests.Session()
s.verify=False
s.trust_env=True
try:
    s.get("https://httpbin.org/get?a=1&b=2").json()
except Exception as e:
    print(e)
    raise e
```

You get the following error:

```
requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
```

So now the type name mismatch isn't happening like with `1.26.6` now this is being bubbled up.  This means `verify` still isn't being honored because `verify=False` should just ignore any SSL certificate.

Now let's specify the proxy for the session:

```
import urllib.request
s.proxies = urllib.request.getproxies()
s.get("https://httpbin.org/get?a=1&b=2").json()
```

This results in the following:

```
requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
```

Same issue. 

Outside of a session:

```
proxy = urllib.request.getproxies()

requests.get("https://httpbin.org/get?a=1&b=2", proxies=proxy, verify=False).json()
```

Result:

```
During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\envs\pro-dev\lib\site-packages\requests\api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "C:\envs\pro-dev\lib\site-packages\requests\api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\envs\pro-dev\lib\site-packages\requests\sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\envs\pro-dev\lib\site-packages\requests\sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "C:\envs\pro-dev\lib\site-packages\requests\adapters.py", line 573, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
```

#### Solution:

TBD


It appears the issue is here: HTTPConnection.set_cert() in urllib3 gets set to REQUIRED when verify is set to False.

@achapkowski What is the last urllib3 version that works for you? That would help us pinpoint and fix the issue.

@pquentin let me know if this helps.


### Setup
1. Manually install urllib3 with latest of requests
2. Open fiddler
3. Run the code below
4. close fiddler GOTO: 1

### Test code:

```python
import requests
import urllib.request
import urllib3

print(urllib3.__version__)
s = requests.Session()
s.verify = False
s.trust_env = True
s.proxies = urllib.request.getproxies()
s.get("https://httpbin.org/get?a=1&b=2").json()
```

Here is the urllib3 versions I tested with:

- **1.25.11** - No issue
- **1.26.0** - requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
- **1.26.1** - requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
- **1.26.2** - requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
- **1.26.3** - requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))
- **1.26.4** - builtins.ValueError: check_hostname requires server_hostname
- **1.26.5** - builtins.ValueError: check_hostname requires server_hostname
- **1.26.6** - builtins.ValueError: check_hostname requires server_hostname
- **1.26.7** - requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))




Yes, that's helpful! My suspicion is that your proxy is actually an HTTP proxy (not HTTPS) but you configure it using an "https://" URL instead of an "http://" one.

@pquentin 

I set the proxies to be both http, and I get the same result as I show above.

```python
{'http': 'http://127.0.0.1:8888', 'https': 'http://127.0.0.1:8888'}
```

@achapkowski Now this is confusing. The error means that we're speaking HTTPS to an HTTP endpoint, which should not be possible based on what you're showing me. Can you please try pure urllib3?

```python3
import urllib3

http = urllib3.ProxyManager("http://127.0.0.1:8888")
http.request("GET", "https://example.com", timeout=5, retries=0)
```

And this version (notice the https proxy) which should reproduce the error you're seeing:

```python3
import urllib3

http = urllib3.ProxyManager("https://127.0.0.1:8888")
http.request("GET", "https://example.com", timeout=5, retries=0)
```

At urllib3 v1.25.11 I do not get an error either way and I get back the payload.

FYI, the urllib.request.getproxies() returns: ```{'http': 'http://127.0.0.1:8888', 'https': 'https://127.0.0.1:8888'}``` and that fails too in requests.

At the 1.26.7, it seems to enter and endless loop and after a few minutes returns:

```requests.exceptions.SSLError: HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1091)')))```

@pquentin I think the best way for you to see what I'm seeing is to just try the reproducible code with fiddler open.  

Can you please clarify what the output of each of those two scripts is, using urllib3 1.26.7? I can't tell from your comment.

> @pquentin I think the best way for you to see what I'm seeing is to just try the reproducible code with fiddler open.

I considered that, but from what I've seen it's proprietary and requires an account.

> FYI, the urllib.request.getproxies() returns: `{'http': 'http://127.0.0.1:8888', 'https': 'https://127.0.0.1:8888'}` and that fails too in requests.

@achapkowski This is your problem, your proxy for HTTPS URLs is returning `https://...` for the proxy URL instead of `http://`. However these proxies are configured in your environment should be fixed and then everything will work as you expect.

Basically `urllib.request.getproxies()` should return `{'http': 'http://127.0.0.1:8888', 'https': 'http://127.0.0.1:8888'}` not `{'http': 'http://127.0.0.1:8888', 'https': 'https://127.0.0.1:8888'}`

I’ve tested it both ways.  If I use the getproxies(), it still fails with the SSL error listed above.


You still haven't provided the output of the two urllib3-only snippets above in a way that I can understand. This would help us help you!

@pquentin I'm working on it today.  When I use the urllib3 version it take a large amount of time to timeout.



@achapkowski Oh! I updated my snippets to avoid this.

Ok here are the results:
- ```Proxy Schema http------------------------``` means I used: http = urllib3.ProxyManager("http://127.0.0.1:8888") was used.
- ```Proxy Schema https------------------------``` means I used: http = urllib3.ProxyManager("https://127.0.0.1:8888") was used

Here is the summary of what I am finding:

- 1.26.7, 1.26.0 to 1.26.3 throw ProxyError with https proxy
- 1.26.4 to 1.26.6 throw ```check_hostname requires server_hostname``` with https proxy
- 1.25.11 sends up a warning with https proxy
```
1.26.7
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by ProxyError('Cannot connect to proxy.', timeout('_ssl.c:1074: The handshake operation timed out')))

1.26.6
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
check_hostname requires server_hostname


1.26.5
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
check_hostname requires server_hostname

1.26.4
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
check_hostname requires server_hostname

1.26.3
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by ProxyError('Cannot connect to proxy.', timeout('_ssl.c:1074: The handshake operation timed out')))

1.26.2
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by ProxyError('Cannot connect to proxy.', timeout('_ssl.c:1074: The handshake operation timed out')))

1.26.1
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by ProxyError('Cannot connect to proxy.', timeout('_ssl.c:1074: The handshake operation timed out')))

1.26.0
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
HTTPSConnectionPool(host='httpbin.org', port=443): Max retries exceeded with url: /get?a=1&b=2 (Caused by ProxyError('Cannot connect to proxy.', timeout('_ssl.c:1074: The handshake operation timed out')))

1.25.11
Proxy Schema http------------------------
No issue
Proxy Schema https------------------------
C:\envs\mytestenv\lib\site-packages\urllib3\request.py:97: InvalidProxyConfigurationWarning: Your proxy configuration specified an HTTPS scheme for the proxy. Are you sure you want to use HTTPS to contact the proxy? This most likely indicates an error in your configuration. Read this issue for more info: https://github.com/urllib3/urllib3/issues/1850
  return self.urlopen(method, url, **extra_kw)
No issue
```

Sorry, I wasn't clear, but testing the latest version was enough.

What is the value of `HTTPS_PROXY`? It should be `http://127.0.0.1:8888` in your case, and I think you have `https://127.0.0.1:8888` instead.

I've testing both http and https:

```
port = "8888"
def call_http(port):
    try:
        http = urllib3.ProxyManager(f"http://127.0.0.1:{port}")
        r = http.request("GET", "https://httpbin.org/get?a=1&b=2", timeout=5, retries=0)
        r.data
        return "No issue"
    except Exception as e:
        return str(e)

def call_https(port):
    try:
        http = urllib3.ProxyManager(f"https://127.0.0.1:{port}")
        r = http.request("GET", "https://httpbin.org/get?a=1&b=2", timeout=5, retries=0)
        r.data
        return "No issue"
    except Exception as e:
        return str(e)
```

What is wrong with the test?


Quentin and I are trying to show you that your proxy only speaks HTTP, not HTTPS.  Your tests above prove this fact.  So any time you specify that your proxy URL is "https" you will have issues.

This is only a problem with your configuration and not with urllib3 or Requests. Set `HTTPS_PROXY=http://127.0.0.1:8888` and things should work.

Some advice for future troubleshooting: when a maintainer asks you directly for a piece of information, provide that first and don't wait until we ask 2 or more times. We're trying to help you and that information is critical for us to do that.

Since this isn't a defect I'm closing this issue. 

(Before 1.26 we were ignoring the scheme, which is why your test used to pass.)

Thank you for the help