bad handshake error with ssl3

I have an inhouse IIS server with ssl3 but an expired certificate, so I used requests without certificate verification and it was working fine with requests 2.11.1. But after I upgrade requests to 2.12.0, there was an error occured. 

the code is:
...
requests.get('https://10.192.8.89:8080/yps_report', verify=False)
...

error message:
Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\packages\urllib3\contrib\pyopenssl.py", line 417, in wrap_socket
    cnx.do_handshake()
  File "c:\python35\lib\site-packages\OpenSSL\SSL.py", line 1426, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "c:\python35\lib\site-packages\OpenSSL\SSL.py", line 1167, in _raise_ssl_error
    raise SysCallError(-1, "Unexpected EOF")
OpenSSL.SSL.SysCallError: (-1, 'Unexpected EOF')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 350, in _make_request
    self._validate_conn(conn)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 835, in _validate_conn
    conn.connect()
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connection.py", line 323, in connect
    ssl_context=context)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\util\ssl_.py", line 324, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\contrib\pyopenssl.py", line 424, in wrap_socket
    raise ssl.SSLError('bad handshake: %r' % e)
ssl.SSLError: ("bad handshake: SysCallError(-1, 'Unexpected EOF')",)
...

I tried  to downgrade requests to 2.11.1 and the error was gone. I have no idea how to fix this.


This is almost certainly because the server in question only supports 3DES as a cipher, which we dropped from our default cipher list because it's insecure. If you operate the server I strongly encourage you to upgrade its cipher suite configuration to support something secure. 

I think you are right. But I don't run the server.... It seems I have to strick to 2.11.1 for good.

There are other options. It is possible to configure a custom SSLContext object that can do what you need. You need a custom HTTPAdapter:

```python
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.ssl_ import create_urllib3_context

# This is the 2.11 Requests cipher string.
CIPHERS = (
    'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
    'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
    '!eNULL:!MD5'
)

class DESAdapter(HTTPAdapter):
    def init_poolmanager(self, *args, **kwargs):
        context = create_urllib3_context(ciphers=CIPHERS)
        kwargs['ssl_context'] = context
        return super(HTTPAdapter, self).init_poolmanager(*args, **kwargs)

s = requests.Session()
s.mount('https://10.192.8.89', DESAdapter())
```

This should work. Please avoid using this too much, and also ensure that you put pressure on the server administrator to update their config: they have *no* secure cipher suites in their config now, which is pretty unacceptable. 

@Lukasa thank you for your reply, but your code doesn't work for me.  
here are my code(minor modified on yours):

```
import sys
import ssl
import requests
from requests_ntlm import HttpNtlmAuth
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.poolmanager import PoolManager
from requests.packages.urllib3.util.ssl_ import create_urllib3_context

# This is the 2.11 Requests cipher string.
CIPHERS = (
    'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
    'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
    '!eNULL:!MD5'
)

requests.packages.urllib3.disable_warnings()

class Ssl3HttpAdapter(HTTPAdapter):
    """"Transport adapter" that allows us to use SSLv3."""
    def init_poolmanager(self, connections, maxsize, block=False):
        self.poolmanager = PoolManager(
            num_pools=connections, maxsize=maxsize,
            block=block, ssl_version=ssl.PROTOCOL_SSLv3)

class DESAdapter(HTTPAdapter):
    def init_poolmanager(self, connections, maxsize, block=False,*args, **kwargs):
        context = create_urllib3_context(ciphers=CIPHERS)
        kwargs['ssl_context'] = context
        self.poolmanager = PoolManager(
            num_pools=connections, maxsize=maxsize,
            block=block, ssl_version=ssl.PROTOCOL_SSLv3,*args, **kwargs)

if __name__=="__main__":

    username="someuser"
    password="thepwd"

    s = requests.Session()

    #s.mount('https://10.192.8.89:8080/yps_report',Ssl3HttpAdapter())
    s.mount('https://10.192.8.89:8080/yps_report',DESAdapter())

    r=s.get('https://10.192.8.89:8080/yps_report',auth=HttpNtlmAuth(username,password),verify=False)

```

same error msg appears:

```
========= RESTART: M:\support control\KPSKTPRC\getKpsfiles - test.py =========
Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\packages\urllib3\contrib\pyopenssl.py", line 417, in wrap_socket
    cnx.do_handshake()
  File "c:\python35\lib\site-packages\OpenSSL\SSL.py", line 1426, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "c:\python35\lib\site-packages\OpenSSL\SSL.py", line 1167, in _raise_ssl_error
    raise SysCallError(-1, "Unexpected EOF")
OpenSSL.SSL.SysCallError: (-1, 'Unexpected EOF')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 350, in _make_request
    self._validate_conn(conn)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 835, in _validate_conn
    conn.connect()
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connection.py", line 323, in connect
    ssl_context=context)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\util\ssl_.py", line 324, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\contrib\pyopenssl.py", line 424, in wrap_socket
    raise ssl.SSLError('bad handshake: %r' % e)
ssl.SSLError: ("bad handshake: SysCallError(-1, 'Unexpected EOF')",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\adapters.py", line 423, in send
    timeout=timeout
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 624, in urlopen
    raise SSLError(e)
requests.packages.urllib3.exceptions.SSLError: ("bad handshake: SysCallError(-1, 'Unexpected EOF')",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "M:\support control\KPSKTPRC\getKpsfiles - test.py", line 44, in <module>
    r=s.get('https://10.192.8.89:8080/yps_report',auth=HttpNtlmAuth(username,password),verify=False)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 501, in get
    return self.request('GET', url, **kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "c:\python35\lib\site-packages\requests\adapters.py", line 497, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: SysCallError(-1, 'Unexpected EOF')",)
```

and under 2.11.1, there was another error which i can fix it by removing the ssl_context key:

```
========= RESTART: M:\support control\KPSKTPRC\getKpsfiles - test.py =========
Traceback (most recent call last):
  File "M:\support control\KPSKTPRC\getKpsfiles - test.py", line 44, in <module>
    r=s.get('https://10.192.8.89:8080/yps_report',auth=HttpNtlmAuth(username,password),verify=False)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 488, in get
    return self.request('GET', url, **kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 475, in request
    resp = self.send(prep, **send_kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 596, in send
    r = adapter.send(request, **kwargs)
  File "c:\python35\lib\site-packages\requests\adapters.py", line 423, in send
    timeout=timeout
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 583, in urlopen
    conn = self._get_conn(timeout=pool_timeout)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 257, in _get_conn
    return conn or self._new_conn()
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 819, in _new_conn
    strict=self.strict, **self.conn_kw)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connection.py", line 210, in __init__
    timeout=timeout, **kw)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connection.py", line 126, in __init__
    _HTTPConnection.__init__(self, *args, **kw)
TypeError: __init__() got an unexpected keyword argument 'ssl_context' 
```

Hrm, it's also possible that you're using PyOpenSSL when you aren't expecting to be. Can you show me the output of `pip freeze`?

For reference, the line:

```python
s.mount('https://10.192.8.89:8080/yps_report',DESAdapter())
```

should be:

```python
s.mount('https://10.192.8.89:8080',DESAdapter())
```

or the error adapter won't be used correctly.

@Lukasa yes,  i installed PyOpenSSL but I don't think it's the cause. I uninstalled it and the error changed to the following:
```
========= RESTART: M:\support control\KPSKTPRC\getKpsfiles - test.py =========
Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 350, in _make_request
    self._validate_conn(conn)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 835, in _validate_conn
    conn.connect()
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connection.py", line 323, in connect
    ssl_context=context)
  File "c:\python35\lib\site-packages\requests\packages\urllib3\util\ssl_.py", line 324, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "C:\Python35\lib\ssl.py", line 377, in wrap_socket
    _context=self)
  File "C:\Python35\lib\ssl.py", line 752, in __init__
    self.do_handshake()
  File "C:\Python35\lib\ssl.py", line 988, in do_handshake
    self._sslobj.do_handshake()
  File "C:\Python35\lib\ssl.py", line 633, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:645)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\python35\lib\site-packages\requests\adapters.py", line 423, in send
    timeout=timeout
  File "c:\python35\lib\site-packages\requests\packages\urllib3\connectionpool.py", line 624, in urlopen
    raise SSLError(e)
requests.packages.urllib3.exceptions.SSLError: EOF occurred in violation of protocol (_ssl.c:645)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "M:\support control\KPSKTPRC\getKpsfiles - test.py", line 45, in <module>
    r=s.get('https://10.192.8.89:8080/yps_report',auth=HttpNtlmAuth(username,password),verify=False)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 501, in get
    return self.request('GET', url, **kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "c:\python35\lib\site-packages\requests\sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "c:\python35\lib\site-packages\requests\adapters.py", line 497, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: EOF occurred in violation of protocol (_ssl.c:645)
```
now the pip freeze is:
C:\Users\bigbagboom>pip freeze
alabaster==0.7.9
anaconda-client==1.4.0
anaconda-navigator==1.1.0
argcomplete==1.0.0
astroid==1.4.8
astropy==1.1.2
Babel==2.3.4
beautifulsoup4==4.4.1
bitarray==0.8.1
blaze==0.9.1
bokeh==0.11.1
boto==2.39.0
Bottleneck==1.0.0
certifi==2016.9.26
cffi==1.9.1
chest==0.2.3
click==6.6
cloudpickle==0.1.1
clyent==1.2.1
colorama==0.3.7
comtypes==1.1.2
conda==4.0.5
conda-build==1.20.0
conda-env==2.4.5
conda-manager==0.3.1
configobj==5.0.6
cryptography==1.7.1
cycler==0.10.0
Cython==0.23.4
cytoolz==0.7.5
dask==0.8.1
datashape==0.5.1
decorator==4.0.10
dill==0.2.4
docutils==0.13.1
dynd===c328ab7
entrypoints==0.2.2
et-xmlfile==1.0.1
fastcache==1.0.2
Flask==0.11.1
Flask-Cors==2.1.2
future==0.16.0
gevent==1.1.2
greenlet==0.4.11
h5py==2.5.0
HeapDict==1.0.0
idna==2.1
imagesize==0.7.1
ipykernel==4.5.2
ipython==5.1.0
ipython-genutils==0.1.0
ipywidgets==4.1.1
isort==4.2.5
itsdangerous==0.24
jdcal==1.3
jedi==0.9.0
Jinja2==2.8
jsonschema==2.5.1
jupyter==1.0.0
jupyter-client==4.4.0
jupyter-console==4.1.1
jupyter-core==4.2.1
lazy-object-proxy==1.2.2
llvmlite==0.9.0
locket==0.2.0
lxml==3.6.0
MarkupSafe==0.23
matplotlib==1.5.1
mccabe==0.5.3
menuinst==1.3.2
mistune==0.7.3
mpmath==0.19
multipledispatch==0.4.8
nbconvert==4.3.0
nbformat==4.2.0
ndg-httpsclient==0.4.2
networkx==1.11
nltk==3.2
nose==1.3.7
notebook==4.1.0
ntlm-auth==1.0.2
numba==0.24.0
numexpr==2.6.1
numpy==1.11.2
odo==0.4.2
openpyxl==2.4.1
ordereddict==1.1
pandas==0.18.0
partd==0.3.2
path.py==0.0.0
patsy==0.4.0
pep8==1.7.0
pickleshare==0.7.4
Pillow==3.4.2
ply==3.8
prompt-toolkit==1.0.9
psutil==5.0.0
py==1.4.31
pyasn1==0.1.9
pycosat==0.6.1
pycparser==2.17
pycrypto==2.6.1
pyexcel==0.3.3
pyexcel-io==0.2.4
pyexcel-xls==0.2.0
pyexcel-xlsx==0.2.3
pyflakes==1.3.0
Pygments==2.1.3
pylint==1.6.4
pyparsing==2.0.3
pyreadline==2.1
pytest==2.8.5
python-dateutil==2.5.1
python-ntlm3==1.0.2
pytz==2016.10
pywin32==220
PyYAML==3.11
pyzmq==16.0.2
QtAwesome==0.3.3
qtconsole==4.2.1
QtPy==1.1.2
requests==2.12.0
requests-ntlm==1.0.0
requests-toolbelt==0.7.0
rope-py3k==0.9.4.post1
scikit-image==0.12.3
scikit-learn==0.17.1
scipy==0.17.0
simplegeneric==0.8.1
singledispatch==3.4.0.3
six==1.10.0
snowballstemmer==1.2.1
sockjs-tornado==1.0.1
sphinx-rtd-theme==0.1.9
spyder==2.3.8
SQLAlchemy==1.0.12
statsmodels==0.6.1
sympy==1.0
tables==3.3.0
texttable==0.8.7
toolz==0.7.4
tornado==4.4.2
traitlets==4.3.1
unicodecsv==0.14.1
urllib3==1.19.1
wcwidth==0.1.7
Werkzeug==0.11.11
win-unicode-console==0.5
wrapt==1.10.8
xlrd==0.9.4
XlsxWriter==0.8.4
xlwings==0.7.0
xlwt==1.1.2
xlwt-future==0.8.0

And for reference, here is some output(successful) with curl 7.50.3:
```
*   Trying 10.192.8.89...
* TCP_NODELAY set
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 10.192.8.89 (10.192.8.89) p
ort 8080 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
} [5 bytes data]
* SSLv3 (OUT), TLS handshake, Client hello (1):
} [131 bytes data]
* SSLv3 (IN), TLS handshake, Server hello (2):
{ [74 bytes data]
* SSLv3 (IN), TLS handshake, Certificate (11):
{ [1069 bytes data]
* SSLv3 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* SSLv3 (OUT), TLS handshake, Client key exchange (16):
} [132 bytes data]
* SSLv3 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* SSLv3 (OUT), TLS handshake, Finished (20):
} [40 bytes data]
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* SSLv3 (IN), TLS change cipher, Client he
llo (1):
{ [1 bytes data]
* SSLv3 (IN), TLS handshake, Finished (20):
{ [40 bytes data]
* SSL connection using SSLv3 / DES-CBC3-SHA
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: C=CN; ST=SH; L=SH; O=XXX; OU=XXX; CN=XXX
*  start date: Jul 13 09:31:03 2013 GMT
*  expire date: Jul 13 09:41:03 2014 GMT
*  issuer: CN=XXXXXXXXX
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Server auth using NTLM with user 'someuser'
} [5 bytes data]
> GET /yps_report/share_dir/XXX/XXXXXXXXXXXXX.xls HTTP/1.1
> Host: 10.192.8.89:8080
> Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
> User-Agent: curl/7.50.3
> Accept: */*
>
{ [5 bytes data]
< HTTP/1.1 401 Unauthorized
< Content-Length: 1251
< Content-Type: text/html
< Server: Microsoft-IIS/6.0
< WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADgAAAAGgooCa6Za/bxp8M0AAAAAAAAAAFQAVABAAAAABQLODgAAAA9QV0tUUFNWUgIAEABQAFc
ASwBUAFAAUwBWAFIAAQAQAFAAVwBLAFQAUABTAFYAUgAEABAAcAB3AGsAdABwAHMAdgByAAMAEABwAHcAawB0AHAAcwB2AHIAAAAAAA==
< X-Powered-By: ASP.NET
< Date: Tue, 20 Dec 2016 00:48:40 GMT
<
* Ignoring the response-body
{ [1251 bytes data]
* Curl_http_done: called premature == 0
100  1251  100  1251    0     0   2113      0 --:--:-- --:--:-- --:--:--  2229
* Connection #0 to host 10.192.8.89 left intact
* Issue another request to this URL: 'https://10.192.8.89:8080/yps_report/share_dir/XXX/XXXXXXXXXXXXX.xls'
* Found bundle for host 10.192.8.89: 0x4cd490 [can pipeline]
* Re-using existing connection! (#0) with host 10.192.8.89
* Connected to 10.192.8.89 (10.192.8.89) port 8080 (#0)
* Server auth using NTLM with user 'someuser'
} [5 bytes data]
> GET /yps_report/share_dir/XXX/XXXXXXXXXXXXX.xls HTTP/1.1
> Host: 10.192.8.89:8080
> Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAACEAIQAWAAAAAAAAADcAAAABwAHANwAAAANAA0A4wAAAAAAAAAAAAAABoKKAu8HJ+fusEEOQg
ho0GY4AyMot6g8k1ZQsSt3Mxi4PdkXtAHr8KmqFa4BAQAAAAAAAID6yM5aWtIBKLeoPJNWULEAAAAAAgAQAFAAVwBLAFQAUABTAFYAUgABABAAUABXAEsAVA
BQAFMAVgBSAAQAEABwAHcAawB0AHAAcwB2AHIAAwAQAHAAdwBrAHQAcABzAHYAcgAAAAAAAAAAAHlwc3VzZXJUQy1HNlJYVUowVzJI
> User-Agent: curl/7.50.3
> Accept: */*
>
{ [5 bytes data]
< HTTP/1.1 200 OK
< Content-Length: 8881658
< Content-Type: application/vnd.ms-excel
< Last-Modified: Mon, 19 Dec 2016 10:07:56 GMT
< Accept-Ranges: bytes
< ETag: "d65911c5df59d21:47c"
< Server: Microsoft-IIS/6.0
< X-Powered-By: ASP.NET
< Date: Tue, 20 Dec 2016 00:48:40 GMT
<
{ [16116 bytes data]
 96 8673k   96 8409k    0     0   737k      0  0:00:11  0:00:11 --:--:--  807k* Curl_http_done: called premature == 0
100 8673k  100 8673k    0     0   728k      0  0:00:11  0:00:11 --:--:--  795k
* Connection #0 to host 10.192.8.89 left intact

```

@ernestoalejo  thank you but I am not sure...  you know 'https://10.192.8.89:8080/yps_report' and 'https://10.192.8.89:8080' can be 2 different sites in IIS's configuration.

> For reference, the line:
> 
> s.mount('https://10.192.8.89:8080/yps_report',DESAdapter())
> should be:
> 
> s.mount('https://10.192.8.89:8080',DESAdapter())
> or the error adapter won't be used correctly.

@bigbagboom They cannot possibly have different configurations for TLS though. IIS can't see what path is being used until after the TLS handshake is complete.

my error was gone by adding 'DES-CBC3-SHA' in the CIPHERS string. sigh...

Thank you @Lukasa  and @ernestoalejo .

and it's also ok with following code:
s.mount('https://10.192.8.89:8080/yps_report',DESAdapter()) 

Hey, I'm not an expert on HTTPS or SSL, and I'm unable to figure out what's wrong with the communication to [the server that I want to scrape](https://www.old.health.gov.il/pages/). According to Chrome developer tools, 

> The connection to this site uses an obsolete protocol (TLS 1.0), an obsolete key exchange (RSA), and an obsolete cipher (3DES_EDE_CBC with HMAC-SHA1).

I've tried the code above, and tried to add `:RSA+3DES-EDE-CBC` to the list of ciphers, but I still get the error:
```

my_venv\Scripts\python.exe Projects/scrape_proj.py/scrape_proj.py
2.17.3
Traceback (most recent call last):
  File "my_venv\lib\site-packages\urllib3\connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "my_venv\lib\site-packages\urllib3\connectionpool.py", line 345, in _make_request
    self._validate_conn(conn)
  File "my_venv\lib\site-packages\urllib3\connectionpool.py", line 844, in _validate_conn
    conn.connect()
  File "my_venv\lib\site-packages\urllib3\connection.py", line 326, in connect
    ssl_context=context)
  File "my_venv\lib\site-packages\urllib3\util\ssl_.py", line 325, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "AppData\Local\Programs\Python\Python35\lib\ssl.py", line 377, in wrap_socket
    _context=self)
  File "AppData\Local\Programs\Python\Python35\lib\ssl.py", line 752, in __init__
    self.do_handshake()
  File "AppData\Local\Programs\Python\Python35\lib\ssl.py", line 988, in do_handshake
    self._sslobj.do_handshake()
  File "AppData\Local\Programs\Python\Python35\lib\ssl.py", line 633, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:645)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "my_venv\lib\site-packages\requests\adapters.py", line 440, in send
    timeout=timeout
  File "my_venv\lib\site-packages\urllib3\connectionpool.py", line 630, in urlopen
    raise SSLError(e)
urllib3.exceptions.SSLError: EOF occurred in violation of protocol (_ssl.c:645)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "Projects/scrape_proj.py/scrape_proj.py", line 48, in <module>
    response = s.get('https://www.old.health.gov.il/pages')
  File "my_venv\lib\site-packages\requests\sessions.py", line 526, in get
    return self.request('GET', url, **kwargs)
  File "my_venv\lib\site-packages\requests\sessions.py", line 513, in request
    resp = self.send(prep, **send_kwargs)
  File "my_venv\lib\site-packages\requests\sessions.py", line 623, in send
    r = adapter.send(request, **kwargs)
  File "my_venv\lib\site-packages\requests\adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: EOF occurred in violation of protocol (_ssl.c:645)

Process finished with exit code 1

```

`pip freeze` gives:

```
certifi==2017.4.17
chardet==3.0.4
idna==2.5
lxml==3.8.0
requests==2.17.3
urllib3==1.21.1
```

What can I do to make requests work with a site like this? I think there should be something about this in the documentation for the module. Should I open a separate issue?

> I've tried the code above, and tried to add `:RSA+3DES-EDE-CBC` to the list of ciphers,

That's not a valid OpenSSL cipher specification. Try adding `DES-CBC3-SHA` instead.

@kwikwag 
Did you solve your problem? I have a similar situation, #4638.

Where to add this DES-CBC3-SHA exactly?