Inconsistent behaviour with https between urllib3 and requestsion. 

In trying to make a https connection as so:

``` shell
(trustmile-api-p2710)jBeast:trustmile james$ python -c "import requests; r = requests.get('https://devapi.trustmile.com/static/index.html', verify=True)"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/api.py", line 67, in get
    return request('get', url, params=params, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/api.py", line 53, in request
    return session.request(method=method, url=url, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/adapters.py", line 447, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)
```

I have latest necessary packages installed:

``` shell
(trustmile-api-p2710)jBeast:trustmile james$ pip freeze | egrep '(requests|urllib3|certifi)'
certifi==2015.11.20.1
requests==2.9.1
urllib3==1.14
```

However, urllib works in the same environment:

``` python
import urllib3
import certifi

http = urllib3.PoolManager(
    cert_reqs='CERT_REQUIRED', # Force certificate check.
    ca_certs=certifi.where(),  # Path to the Certifi bundle.
)

# You're ready to make verified HTTPS requests.
try:
    r = http.request('GET', 'https://devapi.trustmile.com/static/index.html')
    print r.status
except urllib3.exceptions.SSLError as e:
    print e
```

Output is status 200.

Am I missing something? I tried to set the relevant environment variables. The cert is a legit one and it's root cert is in the cacerts.pem in certifi package. 

Thanks again for an awesome package I use all the time Kenneth et al!


Out of interest, what version of OpenSSL are you using? Run `python -c 'import ssl; print ssl.OPENSSL_VERSION'`


OpenSSL 0.9.8zg 14 July 2015


Interesting. Does this problem occur if you don't pass `verify=True`?


Yep, same issue


Hmm. What other packages do you have installed?


Ah, that must be it, created a clean env with just certifi, requests, and urllib3 in it. Will investigate further. I have a lot installed.


ok, fixed in my env. Not sure which was the culprit but this worked

``` shell
pip uninstall backports.ssl-match-hostname
pip uninstall pyOpenSSL
```


Yeah, so PyOpenSSL is the likely culprit. Requests, unlike urllib3, will automatically try to use PyOpenSSL if it's present. Can you reinstall it, and then run your urllib3 script with these two lines added to the top:

``` python
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
```


Your script would look like this:

``` python
import urllib3
import urllib3.contrib.pyopenssl
import certifi

urllib3.contrib.pyopenssl.inject_into_urllib3()

http = urllib3.PoolManager(
    cert_reqs='CERT_REQUIRED', # Force certificate check.
    ca_certs=certifi.where(),  # Path to the Certifi bundle.
)

# You're ready to make verified HTTPS requests.
try:
    r = http.request('GET', 'https://devapi.trustmile.com/static/index.html')
    print r.status
except urllib3.exceptions.SSLError as e:
    print e
```