Requests is not doing SSL cert verification

This works fine and shouldn't:

```
>>> requests.get('https://kennethreitz.com', verify=True)
<Response [200]>
```


`requests.exceptions.SSLError: hostname 'kennethreitz.com' doesn't match either of '*.herokuapp.com', 'herokuapp.com'`


Yes, this is what I am expecting. But I don't get an error.


What version of Requests are you using? What operating system? 


```
>>> requests.__version__ 
'0.13.0'
```

Windows 7, 64bit.


Ok, hacking a `print scheme` in urllib3.connectionpool.connection_from_url is interesting:

```
>>> import requests; requests.get('https://google.com')
http
http
http
<Response [200]>
```


That's... interesting. @shazow ?


There is an issue with the proxy handling, `print url,scheme` gives:

```
$ python -c "import requests; requests.get('https://google.com')"
http://.../ http
http://.../ http
http://.../ http
```


What proxies do you have set, where, and how?


```
>>> os.environ['http_proxy']
'http://.../'
>>> os.environ['https_proxy']
'http://.../'
```


Additional note: HTTPS is fully disabled, the data is sent in plain text. Just checked my network traffic.


I'm not positive, but I believe it should be:

``` pycon
>>> os.environ['https_proxy']
'https://10.10.1.1:4128/'
```


Nope:

```
>>> os.environ['https_proxy'] = 'https://.../'
>>> import requests; requests.get('https://google.com')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\Python27\lib\site-packages\requests\api.py", line 54, in get
    return request('get', url, **kwargs)
  File "C:\Python27\lib\site-packages\requests\safe_mode.py", line 37, in wrapped
    return function(method, url, **kwargs)
  File "C:\Python27\lib\site-packages\requests\api.py", line 42, in request
    return s.request(method=method, url=url, **kwargs)
  File "C:\Python27\lib\site-packages\requests\sessions.py", line 230, in request
    r.send(prefetch=prefetch)
  File "C:\Python27\lib\site-packages\requests\models.py", line 611, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 8] _ssl.c:503: EOF occurred in violation of
 protocol
```


Anything going on here? I think this is a serious security flaw which should be fixed ASAP.


@shazow, any insight here?


@ms4py Can you reproduce this with plain urllib3? If so, could you open a bug there please?


@shazow I think the problem is that I am doing HTTPS over an HTTP proxy. It seems that this is fixed in #478. 

@kennethreitz I think this pull request hadn't made it into requests, right?


@ms4py merged. It'll be included in the next release of requests. :cake:


@kennethreitz Not sure what you merged, but if it was anything to do with this bug, it probably isn't a good idea. :)

urllib3 has some related pull requests and an in-progress branch but none of them are ready (and in fact has known bugs).


1. Why is this marked as closed?
2. Why isn't this mentioned somewhere in the docs as long as it isn't fixed. This is a really **BIG** security issue as data is sent in plain text when user is expecting an encrypted connection and he isn't secure against MITM attacks.


The best behavior right now (as long as `urllib3` does not support SSL via proxies) would be to throw an exception instead of silently switching to HTTP.