[BUG] Requests ignoring setting OP_NO_SSLv3

Hello,
i'm trying to get a domain on a private server, but requests get continuously fails with sslv3 alert handshake failure.

I have configured the session to ignore sslv3 according to the blog post here https://lukasa.co.uk/2017/02/Configuring_TLS_With_Requests/
 but it continues using it as statet in the exception message.

Any ideas what i am making wrong here?

Heres my minimal script:

```python
import ssl
import requests
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.ssl_ import create_urllib3_context

CIPHERS = (
    'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
    'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
    '!eNULL:!MD5'
)

class DESAdapter(HTTPAdapter):
    """
    A TransportAdapter that re-enables 3DES support in Requests.
    """
    def create_ssl_context(self):
        ctx = ssl.create_default_context()
        # opt out the SSLv3
        ctx.options |= ssl.OP_NO_SSLv3
        ctx.set_ciphers( CIPHERS )
        return ctx
    
    def init_poolmanager(self, *args, **kwargs):
        kwargs['ssl_context'] = self.create_ssl_context()
        return super(DESAdapter, self).init_poolmanager(*args, **kwargs)

    def proxy_manager_for(self, *args, **kwargs):
        kwargs['ssl_context'] = self.create_ssl_context()
        return super(DESAdapter, self).proxy_manager_for(*args, **kwargs)

s = requests.Session()
s.mount('https://my-broken-intranet-domain.net:4942', DESAdapter())

# This will throw the error:
r = s.get('https://my-broken-intranet-domain.net:4942')
```




Exception has occurred: requests.exceptions.SSLError
HTTPSConnectionPool(host='my-broken-intranet-domain.net', port=4942): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))

With Curl, the request goes trough and the negotiated CIPHER and TLS are:

> curl -v https://my-broken-intranet-domain.net:4942
```
...
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / DES-CBC3-SHA
* ALPN, server did not agree to a protocol
```

Versions:
Python 3.7.2

Name: requests
Version: 2.21.0

Name: urllib3
Version: 1.24.1

OpenSSL
1.1.0j

Thanks for the help!


Ok guys, the Problem is related to Python 3.7.2.

I checked version 3.6.8 and the request goes through.

I believe it is due to some kind of packaged OpenSSL, that comes with this version.

Can someone please create a bug from this to check it?

I am currently seeing the same thing in __Python 2.7.13__ and __Python 3.5.3__ , running latest requests and urllib3 via pip2 && pip3 ` install --force-reinstall --no-cache-dir requests`
```
>>> import requests
>>> requests.__version__
'2.22.0'
>>> import urllib3
>>> urllib3.__version__
'1.25.3
>>>
```

openssl on my system is 1.1.0j distro is __Debian 9.9__... 

One weird thing i did notice

```
>>> import ssl
>>> print ssl.OPENSSL_VERSION
OpenSSL 1.1.0j  20 Nov 2018
>>> import OpenSSL
>>> print OpenSSL.SSL.SSLeay_version(0)
OpenSSL 1.1.1c  28 May 2019
>>>
```

Site i'm testing with is https://www.howsmyssl.com/a/check

I have tested with a mount pool manager HTTPAdapter using `ssl.SSLContext()` and `create_urllib3_context()`

Now... the weird thing is... if i don't specify a cipher at all... it works...

without any cipher set.. I see a return content of

```
b'{"given_cipher_suites":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_DHE_DSS_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","TLS_DHE_DSS_WITH_AES_128_GCM_SHA256","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_RSA_WITH_CHACHA20_POLY1305","TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8","TLS_ECDHE_ECDSA_WITH_AES_256_CCM","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_DHE_RSA_WITH_AES_256_CCM_8","TLS_DHE_RSA_WITH_AES_256_CCM","TLS_DHE_RSA_WITH_AES_256_CBC_SHA256","TLS_DHE_DSS_WITH_AES_256_CBC_SHA256","TLS_DHE_RSA_WITH_AES_256_CBC_SHA","TLS_DHE_DSS_WITH_AES_256_CBC_SHA","TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8","TLS_ECDHE_ECDSA_WITH_AES_128_CCM","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_RSA_WITH_AES_128_CCM_8","TLS_DHE_RSA_WITH_AES_128_CCM","TLS_DHE_RSA_WITH_AES_128_CBC_SHA256","TLS_DHE_DSS_WITH_AES_128_CBC_SHA256","TLS_DHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_DSS_WITH_AES_128_CBC_SHA","TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384","TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384","TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256","TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256","TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256","TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256","TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA","TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA","TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_CCM_8","TLS_RSA_WITH_AES_256_CCM","TLS_RSA_WITH_AES_128_CCM_8","TLS_RSA_WITH_AES_128_CCM","TLS_RSA_WITH_AES_256_CBC_SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256","TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256","TLS_RSA_WITH_CAMELLIA_256_CBC_SHA","TLS_RSA_WITH_CAMELLIA_128_CBC_SHA","TLS_EMPTY_RENEGOTIATION_INFO_SCSV"],"ephemeral_keys_supported":true,"session_ticket_supported":true,"tls_compression_supported":false,"unknown_cipher_suite_supported":false,"beast_vuln":false,"able_to_detect_n_minus_one_splitting":false,"insecure_cipher_suites":{},"tls_version":"TLS 1.2","rating":"Probably Okay"}'
```

if i set a cipher I see...

```
HTTPSConnectionPool(host='www.howsmyssl.com', port=443): Max retries exceeded with url: /a/check (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:720)'),))
``` 

Full trace..

```
Traceback (most recent call last):
  File "./test.py", line 62, in <module>
    ret = session.get('https://www.howsmyssl.com/a/check')
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 546, in get
    return self.request('GET', url, **kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='www.howsmyssl.com', port=443): Max retries exceeded with url: /a/check (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:720)'),))
```

```python
import requests
import ssl
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.ssl_ import create_urllib3_context

class CipherSuiteAdapter(HTTPAdapter):
    def __init__(self, cipherSuite=None, **kwargs):
        self.ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
        self.ssl_context.options |= ssl.OP_NO_SSLv2
        self.ssl_context.options |= ssl.OP_NO_SSLv3
        self.ssl_context.set_ciphers(cipherSuite)
        #create_urllib3_context(ssl.PROTOCOL_TLSv1_2, ciphers=cipherSuite)
        super(CipherSuiteAdapter, self).__init__(**kwargs)

    #########################################################################

    def init_poolmanager(self, *args, **kwargs):
        kwargs['ssl_context'] = self.ssl_context
        return super(CipherSuiteAdapter, self).init_poolmanager(*args, **kwargs)

#########################################################################

session = requests.session()
session.mount('https://', CipherSuiteAdapter(cipherSuite='ECDHE-ECDSA-AES128-GCM-SHA256'))
session.get('https://www.howsmyssl.com/a/check')
```

@Lukasa , I know you've seen this error before from see'ing various tickets / issues... im yet to find a solution that works however, do you have any insight at all?

I got the same issue on windows using __python 2.7.11__

```
>>> requests.__version__
'2.22.0'
>>> import urllib3
>>> urllib3.__version__
'1.25.2'
>>> import ssl
>>> print ssl.OPENSSL_VERSION
OpenSSL 1.0.2d 9 Jul 2015
>>>
```

This error appears to be something specific to certain types of ciphers chosen... ie "AES256-GCM-SHA384" works fine and does not generate the SSLv3 handshake issue.

@Lukasa could this be related to SNI at all?

I don't think this is a defect in Requests specifically. Would require more testing to track down the source (including potentially taking pcaps of the handshake in Wireshark). Closing this for now.