SSL "unknown protocol" is returned when it should be "certificate verify failed"

This may be related to issue #606 and is caused by pull request #799.

With requests 0.14.0, if you attempt to visit a site with a certificate whose CA is not trusted and who doesn't support SSLv2, you'll get an error like this:

```
_ssl.c:480: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
```

when you should instead be getting an error like this:

```
_ssl.c:480: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```

This is because `SSLError` is caught when calling `ssl.wrap_socket()` in `VerifiedHTTPSConnection` attempting only a SSLv3 connection and then tries SSLv23.  Since my server doesn't support SSLv2, the latter call throws the "unknown protocol" error.  From my interpretation of issue #606 it seems like that was an intentional OpenSSL policy decision (although reversed in later OpenSSL?)

Requests 0.12.1 returns the right error.  This is testing on Ubuntu 10.04 LTS (Lucid) with Python 2.6.5 and OpenSSL 0.9.8k-7ubuntu8.13


Hmm, maybe this belongs in urllib3. @shazow ?


@joeshaw If the issue is under VerifiedHTTPSConnection, then please re-open this under https://github.com/shazow/urllib3. :)


Ack, sorry, this problem was caused by pull request #799, not #797.


It would appear as though the code that causes the problem (in #799) is only in requests and not in urllib3?  (At least as of shazow/urllib3@dfe0ea1f9)


Sorry, didn't mean to break stuff. 


@joequery not your fault ;)


Is this ticket still open and considered "contributor friendly"?


As far as I'm aware, yes. =)


I'm fairly sure this issue is resolved, so I'm closing it unless someone tells me otherwise. =)


Yes, it was fixed by reverting #799.  See the comments there for more info, including a link to a couple relevant urllib3 issues/pull requests.


The issue brought up by #799 isn't resolved as far as I can tell. I realize my commit broke some things, but I'm still unable to circumvent the issue. Perhaps the issue was resolved without documentation change, but I still see no way to force SSLv3. Many of the fixes described in various issue threads involved updating Python to 2.7.3, specifically on OS X. There are no resolutions for Ubuntu users having the issue AFAIK. 

I've resorted to maintaining a fork of requests that has the change introduced by #799 but merges everything else from this main repo. 


@joequery: Is your specific issue that you need to force SSLv3 on Ubuntu?


@joequery If you are able to run (or update to) requests 1.0, https://github.com/kennethreitz/requests/issues/1083#issuecomment-11853729 might be helpful.


There is also https://github.com/shazow/urllib3/pull/109 but I'm not sure when/how/if that is available in requests.


Yes. I'm not trying to cause a stir or anything, it's just that none of the commits since opening the issue have resolved my problem. The issue only occurs on certain sites. University websites seem to be prone to enforcing SSLv3.

@joeshaw #1083 looks like a good solution. However, I'm a bit confused since the code provided says it works for pre 1.0. I don't see examples provided for post 1.0. 

And the when/how/if is pretty much the exact problem I'm having. If there's a way to interface with urllib3 to choose ssl version, I don't see it in the docs. 


@joequery: You aren't creating a stir. =) If you're having a problem, we want to fix it.

#1083 absolutely does **not** work pre version 1. I should know, I wrote it. =) In fact, the first sentence reads:

> Requests does not support doing this before version 1.

The examples provided are for post v1.

You are correct that this is not in the docs, and I don't think it belongs there. If you want a more detailed explanation, I have a [blog post about it](http://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/).


My mistake. Man, my English is pretty bad. I though subsequent meant "before", so I was confused... >_>


No worries. =) Does #1083 resolve your problems?