response unconnected with stream=True for some SSL sites

Hi,

with some SSL sites and stream=True the SSL socket seems to be unconnected. Calling connect() manually helps (see test script output below).
I expected that the behaviour is consistent, ie. after calling requests.get() the socket is connected but with no data read because of stream=True.

The test script:

```
import requests
url = "https://github.com/"
response = requests.get(url, stream=True)
print url, "sock", response.raw._connection.sock
url = "https://www.ahold.com/"
response = requests.get(url, stream=True)
print url, "sock", response.raw._connection.sock
response.raw._connection.connect()
print url, "sock after connect", response.raw._connection.sock
```

Output:

```
https://github.com/ sock <ssl.SSLSocket object at 0x27792a8>
https://www.ahold.com/ sock None
https://www.ahold.com/ sock after connect <ssl.SSLSocket object at 0x7ff033a83578>
```

Version info:
It's a Debian Linux wheezy system.

```
Python 2.7.3 (default, Mar 13 2014, 11:03:55)
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests; print requests.__version__
2.2.1
>>>
```

ps: maybe this is an urllib3 problem - I'm not sure.


What effect does this have when using `requests`? Does it impede your ability to read data?


I can reproduce this but I have the same question as @Lukasa 


I use requests for link checking. Every check first connects to the http(s) site, then if there are no errors and the content should be read (this is configurable) the content is checked.

The connection is done with session.get(stream=False). When this succeeds, the content is read with iter_content(). I want to ensure that session.get(stream=False) actually makes a connection ready to be read from. This guarantees that unconnectable servers or invalid SSL certificates are detected by the link checker, even if the user configured that the content of the URL should not be checked.

Right now this is the workaround for ssl connections I am using in https://github.com/wummel/linkchecker/blob/master/linkcheck/plugins/sslcertcheck.py#L62
(url_data.url_connection is the response object):

```
    [...]
    raw_connection = url_data.url_connection.raw._connection
    if raw_connection.sock is None:
        # sometimes the socket is not yet connected
        # see https://github.com/kennethreitz/requests/issues/1966
        raw_connection.connect()
    ssl_sock = raw_connection.sock
    cert = ssl_sock.getpeercert()
    [...]
```


It feels like you're fighting `requests` here. Firstly, why are you doing certificate verification yourself?


The other thing that is crucial to note is that `_connection` is an implementation detail. If you're mucking with that and getting burned or unexpected behaviour, that's neither our nor urllib3's fault. That's your own fault. If this is manifesting itself in other ways through public APIs then that's different.


The reason I want to get the certificate data is to warn users if it expires soon.
I agree the code above is using implementation-specific details. Is there another way to get the certificate data, or more specific to get the expiration date on the SSL certificate?


The only way I can think of doing it is at a point when you know the connection to be open, and neither requests nor urllib3 makes it easy to do this. It is possible that urllib3 would be open to a feature request that stores off SSL certificates on a connection object, but that's at the discretion of that project.


Ok, added some comments to https://github.com/shazow/urllib3/pull/257.