SSL verification broken if using a proxy

According to #1204 `requests` should fully support HTTP proxies. However, the SSL verification is broken on my system.

If requesting without a proxy, I'm getting as expected:

```
>>> requests.get('https://kennethreitz.org')
requests.exceptions.SSLError: hostname 'kennethreitz.org' doesn't match either 
of '*.herokuapp.com', 'herokuapp.com'
```

However, doing the same request via an HTTP proxy:

```
>>> proxies = {'http': 'http://...', 'https': 'http://...'}
>>> requests.get('https://kennethreitz.org', proxies=proxies)
<Response [200]>
```


No it isn't. I mean, there are some proxy bugs, but this isn't one, I don't think.

I've not tested this, but I bet that if you run an HTTPS request over an HTTP connection to a proxy, the proxy does the HTTPS termination and then forwards the request to you in plaintext (you should be able to see this in Wireshark). Thus, your proxy is handling the SSL (and ignoring the certificate failure).

Unfortunately, you can't do HTTPS over HTTPS proxies yet because urllib3 doesn't yet support the CONNECT verb. See shazow/urllib3#139.


@Lukasa 
And how do you explain this:

```
$ curl https://stackoverflow.com/
curl: (51) SSL peer certificate or SSH remote key was not OK

$ python -c "import requests; print requests.get('https://stackoverflow.com/')"
<Response [200]>

$ export | grep http
declare -x http_proxy="http://.../"
declare -x https_proxy="http://.../"
```


Ah, I see. This is really an issue of my proxy. Curl is doing `CONNECT ...` over the proxy while requests is doing a `GET ...`. However, with https://github.com/shazow/urllib3/issues/139 applied it does a CONNECT, but I'm still getting the `<Response 200>`.


@Lukasa After reading http://curl.haxx.se/mail/lib-2010-03/0018.html I would say that the current behavior is broken in requests! Doing `GET https` on a proxy is non-standard behavior.

However it should be fixed with https://github.com/shazow/urllib3/issues/139 (assuming the cert verification issue will be solved) so I think this issue can be left as closed.


@schlamar: I think you're right too, though I don't have the time right now to really explore it.

As and when urllib3 gets sorted I'll probably give you a nudge because it sounds like your network is set up to test this. =D


@Lukasa Please also nudge me :)

Being able to access an HTTPS site through an HTTP(S) proxy is a critical requirement for me, and I have the environment to test it.

FYI, my workaround right now is to read stdout from `curl` in a subprocess. Yuck :p


@maxbane What about urllib2: https://gist.github.com/schlamar/2993700


@schlamar That would be one option. I actually ended up using pycurl, the python bindings for libcurl.


@maxbane consider yourself on a list :-P


I also have an environment to test this action, and actually have successfully used the new https proxy changes in urllib3 to poke through my corporate proxy.


@ciphercast you're on the list now too. (Don't worry the list is as ambiguous as it seems ;))


@Lukasa urllib3 seems to be fixed with https://github.com/shazow/urllib3/pull/139. But requests on top of it is still not doing the certificate verification. See my comment (which includes a fully automated test): https://github.com/shazow/urllib3/pull/139#issuecomment-14367341 Any idea?

@maxbane Mind if you run the test mentioned above on your setup? :)


I'm pretty sure SSL verification in Requests is actually handled by urllib3, so urllib3 should be doing it. I can't guarantee that, and I have to go to work now, but I'll take a look at this when I get back.


@Lukasa Found the issue, see my changes at https://github.com/schlamar/requests/tree/new-urllib3-api.


As soon as https://github.com/shazow/urllib3/issues/139 gets merged I send a clean pull request :)


Awesome, I look forward to it. =)


@maxbane @ciphercast There is a requests HTTPS proxy ready version to test, can you give it a try: https://github.com/shazow/urllib3/pull/170#issuecomment-21234629

@sigmavirus24 Anyone else on your list? :)