Repository: urllib3/urllib3

Issue:
Connection retrieved from connection pool has wrong cert_reqs (based on previous request)
Based on the issue on requests library: https://github.com/kennethreitz/requests/issues/2314
I´ve found that when you want to perform a request with `self.cert_reqs=='CERT_NONE'`sometimes (if there has been a previous connection with CERT_REQUIRED) the connection retrieved from the connection pool has CERT_REQUIRED:

```
> /Users/raulcd/Projects/requests/requests/packages/urllib3/connectionpool.py(511)urlopen()
    510             # Request a connection from the queue.
--> 511             conn = self._get_conn(timeout=pool_timeout)
    512

ipdb> self.cert_reqs
'CERT_NONE'
ipdb> n
ipdb> conn.cert_reqs
'CERT_REQUIRED'
```

So the requests should have `CERT_NONE` but the connection retrieved from the connection pool has `CERT_REQUIRED`.

I'll work in a fix.



Discussion:

Resolving patch:
diff --git a/urllib3/connectionpool.py b/urllib3/connectionpool.py
--- a/urllib3/connectionpool.py
+++ b/urllib3/connectionpool.py
@@ -539,9 +539,12 @@ def urlopen(self, method, url, body=None, headers=None, retries=None,
             raise EmptyPoolError(self, "No pool connections are available.")
 
         except (BaseSSLError, CertificateError) as e:
-            # Release connection unconditionally because there is no way to
-            # close it externally in case of exception.
-            release_conn = True
+            # Close the connection. If a connection is reused on which there
+            # was a Certificate error, the next request will certainly raise
+            # another Certificate error.
+            if conn:
+                conn.close()
+                conn = None
             raise SSLError(e)
 
         except (TimeoutError, HTTPException, SocketError, ConnectionError) as e:


Test patch:
diff --git a/test/with_dummyserver/test_https.py b/test/with_dummyserver/test_https.py
--- a/test/with_dummyserver/test_https.py
+++ b/test/with_dummyserver/test_https.py
@@ -330,6 +330,8 @@ def test_enhanced_ssl_connection(self):
         https_pool._make_request(conn, 'GET', '/')
 
     def test_ssl_correct_system_time(self):
+        self._pool.cert_reqs = 'CERT_REQUIRED'
+        self._pool.ca_certs = DEFAULT_CA
         with warnings.catch_warnings(record=True) as w:
             warnings.simplefilter('always')
             self._pool.request('GET', '/')
@@ -337,6 +339,8 @@ def test_ssl_correct_system_time(self):
         self.assertEqual([], w)
 
     def test_ssl_wrong_system_time(self):
+        self._pool.cert_reqs = 'CERT_REQUIRED'
+        self._pool.ca_certs = DEFAULT_CA
         with mock.patch('urllib3.connection.datetime') as mock_date:
             mock_date.date.today.return_value = datetime.date(1970, 1, 1)
 
@@ -370,6 +374,12 @@ def test_ssl_version_as_short_string(self):
         self._pool.ssl_version = 'SSLv3'
         self.assertRaises(SSLError, self._pool.request, 'GET', '/')
 
+    def test_discards_connection_on_sslerror(self):
+        self._pool.cert_reqs = 'CERT_REQUIRED'
+        self.assertRaises(SSLError, self._pool.request, 'GET', '/')
+        self._pool.ca_certs = DEFAULT_CA
+        self._pool.request('GET', '/')
+
 
 class TestHTTPS_NoSAN(HTTPSDummyServerTestCase):
     certs = NO_SAN_CERTS