Problems in SSL communication

Hi again!

This issue is related to the closed issue #2383 
I have now investigated further. I have tried a different client agains the server, and this communication works fine. I have used wireshark to see how the handshake goes. With the java client things works out fine, but when using requests, the connection terminates with an Encrypted alert after the change Cipher spec.

When I look at protocol in Wireshark, I see TLSv1 even if I change protocol using the SSLAdapter in the requests_toolbelt. Is this correct? 

I use OpenSSL 1.0.1h 5 Jun 2014. 
Could it be wise to try a different OpenSSL version? Which version is compatible with requests version 2.5.1?

Regards
Tor Erik 


requests can and does use whatever version of OpenSSL Python is compiled against. There is no bug in requests from what I can tell and the SSLAdapter in `requests_toolbelt` just works for me on both OpenSSL 1.0.1 and 0.9.8. If you need help with your code, please post your question on [StackOverflow](https://stackoverflow.com/questions/tagged/python-requests) with the code you're using and having problems with. The issue tracker is not a support forum.


Hi @tesande , were you able to resolve the issue. I have a similar case where I have  a server accepting tlsv1 and client using a request adapter with tlsv1. 
My gunicorn server  config 
keyfile = '/path/to/keyfile'
certfile = '/path/to/certfile'
ca_certs = '/path/to/ca/cert'
cert_reqs = ssl.CERT_OPTIONAL
ssl_version = ssl.PROTOCOL_TLSv1
do_handshake_on_connect = True

My client code looks like this:
requests_session = requests.Session()
requests_session.mount('https://', TLSAdapter)
resp = requests.request(request.http_method, request.full_uri, data=request.data, headers=request_headers, verify=verify, cert=(cert, key))

// tlsv1 adapter
class TLSAdapter(HTTPAdapter):
  def init_poolmanager(self, connections, maxsize, block=False):
    self.poolmanager = PoolManager(num_pools=connections,
                                   maxsize=maxsize,
                                   block=block,
                                   ssl_version=ssl.PROTOCOL_TLSv1)

I get this
TransportException: TransportException : <urlopen error [Errno 1] _ssl.c:493: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol>

Going into server logs, I also find these:
 _ssl.c:493: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number


Hi!

My web server version was from 2003. After updating, things worked fine.

However, if you don't need certification validation, you can turn that off. That might solve your problem

Date: Fri, 17 Jul 2015 14:01:21 -0700
From: notifications@github.com
To: requests@noreply.github.com
CC: tekvisle@hotmail.com
Subject: Re: [requests] Problems in SSL communication (#2401)

Hi @tesande , were you able to resolve the issue. I have a similar case where I have  a server accepting tlsv1 and client using a request adapter with tlsv1. 

My gunicorn server  config 

keyfile = '/path/to/keyfile'

certfile = '/path/to/certfile'

ca_certs = '/path/to/ca/cert'

cert_reqs = ssl.CERT_OPTIONAL

ssl_version = ssl.PROTOCOL_TLSv1

do_handshake_on_connect = True

My client code looks like this:

requests_session = requests.Session()

requests_session.mount('https://', TLSAdapter)

resp = requests.request(request.http_method, request.full_uri, data=request.data, headers=request_headers, verify=verify, cert=(cert, key))

// tlsv1 adapter

class TLSAdapter(HTTPAdapter):

  def init_poolmanager(self, connections, maxsize, block=False):

```
self.poolmanager = PoolManager(num_pools=connections,

                               maxsize=maxsize,

                               block=block,

                               ssl_version=ssl.PROTOCOL_TLSv1)
```

I get this

TransportException: TransportException : 

Going into server logs, I also find these:

 _ssl.c:493: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

—
Reply to this email directly or view it on GitHub.