Repository: streamlink/streamlink

Issue:
Enable certificate verification for Twitch
### Description

Certificate verification is disable when making API calls in the Twitch plugin. According to comments in the code, "The certificate used by Twitch cannot be verified on some OpenSSL versions." The commit to disable verification was done 3 years ago during Livestreamer development, but the specifics are unclear. 

It might be risky to re-enable it and wait for people to complain that it doesn't work. The issue could be limited to Python 2.6 or perhaps Windows? I have no problems enabling certificate verification on Python 2.7/3.5/3.6 under Linux or macOS.

The question is how should we go about re-enabling the verification?

### Expected / Actual behaviour

Streamlink should _always_ verify SSL certificates, but it does not.

### Environment details

Streamlink and Python version: `streamlink<=0.6.0`

Related to #963 
InsecureRequestWarning error on connecting to Twitch channels
### Checklist

- [x] This is a bug report.
- [ ] This is a feature request.
- [ ] This is a plugin (improvement) request.
- [ ] I have read the contribution guidelines.

### Description

error on connecting to Twitch channels
(formatted to increase readability):

    <user-pip-folder>/lib/python3.5/site-packages/urllib3/connectionpool.py:852
    InsecureRequestWarning: Unverified HTTPS request is being made.
    Adding certificate verification is strongly advised.
    See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings

### Environment details

Xubuntu 16.04 LTS
Streamlink 0.6.0
Python 3.5.2

### Other notes

My streamlink invocation (which I've been using since livestreamer days):

    streamlink \
    --http-header (Twitch ID) \
    --retry-open 8000 \
    --retry-streams 10 \
    --player-continuous-http \
    --player-passthrough hls \
    --hls-segment-threads 3 \
    --player "mpv" \
    URL


Discussion:
I did some digging:

- The commit that added it: https://github.com/chrippa/livestreamer/commit/5f6a3d3fe24f50b161be66e711db2989eea1e378
- The issue describing the problem: https://github.com/chrippa/livestreamer/issues/255

Seemed to be two problems:
1. A specific version of `ca-certificates` for Arch Linux
2. MITM-proxies

I don't think the first issue is still relevant. However, the second part should be investigated.
I don't think there are any reasons for keeping this disabled.
That's weird, certificate verification should be enabled on  any https request. Can you try curling the URL and see if it also gives a warning about certificates? 
Sure, here is the output

    curl https://twitch.tv/<channel-name>

    <html>
    <head><title>302 Found</title></head>
    <body bgcolor="white">
    <center><h1>302 Found</h1></center>
    <hr><center>nginx</center>
    </body>
    </html>
@beardypig the twitch plugin explicitly disables certificate verification:

https://github.com/streamlink/streamlink/blob/master/src/streamlink/plugins/twitch.py#L207
```
# The certificate used by Twitch cannot be verified on some OpenSSL versions.
res = http.get(url, params=params, verify=False, headers=headers)
```

changing to `verify=True` removes the warnings.

what's interesting is streamlink should be silencing these InsecureRequestWarnings:

https://github.com/streamlink/streamlink/blob/master/src/streamlink/plugin/api/http_session.py#L20
```
# We tell urllib3 to disable warnings about unverified HTTPS requests,
# because in some plugins we have to do unverified requests intentionally.
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
```

so the crux of this issue is that call to disable_warnings is no longer working.  if i remove the `try`/`except` block it works, so it isn't throwing an exception.

i can still suppress the warning by setting the `PYTHONWARNINGS` environmental variable, so it's possible:
```
PYTHONWARNINGS="ignore:Unverified HTTPS request" streamlink https://www.twitch.tv/sovietwomble
```
Ah true... I'll try to recreate it, I haven't seen those warnings recently... @globau do you get the warnings? Which python version/OS are you running? 
@beardypig yes - Python 2.7.13 (homebrew) on OSX 10.12.5.
@globau @v1kn could you let me know which version of `requests` and `urllib3` you are using. You should be able to find the versions by using `pip freeze`. 
@beardypig 
Up till yesterday I had `requests 2.16.5`. My systemd service for updating pip packages ran yesterday, now the package is `2.17.3`, and the issue is gone. No more errors.

So this was a `requests` thing?
@beardypig `requests 2.16.5` and `urllib3 1.21.1`.
With `2.16.x` I do get the warnings, with `2.17.1+` I do not get the warnings, `2.15.x` also does not give the warnings. It appears to be an issue with `requests`.

@globau are you able to update to `requests>=2.17.1`.
@beardypig 
good to know. For me the issue is resolved, at least for now.
@beardypig yes, upgrading requests resolves this issue for me too.
From testing, versions `2.16.0`, `2.16.1`, `2.16.2`, `2.16.3`, `2.16.4`, `2.16.5`, `2.17.1` are all affected.
Other then editing the twitch.py file and change # The certificate used by Twitch cannot be verified on some OpenSSL versions.
res = http.get(url, params=params, verify=False, headers=headers) to True, is there something I can add to the configuration file to make it bypass the InsecureRequestWarning?

You can try the latest nightly, I think it should have the fix now... 
Just tested the latest nightly and still

```
[cli][info] Found matching plugin twitch for URL twitch.tv/crream
[plugin.twitch][info] Attempting to authenticate using OAuth token
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings  InsecureRequestWarning)
[plugin.twitch][info] Successfully logged in as Thinkpad4
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings  InsecureRequestWarning)
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings  InsecureRequestWarning)
[plugin.twitch][info] crream is hosting admiralbahroo
[plugin.twitch][info] hosting was disabled by command line optiond:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings  InsecureRequestWarning)
error: No playable streams found on this URL: twitch.tv/crream
```

Edit, copying the Requests folder from here https://pypi.python.org/packages/6d/ed/3adebdc29ca33f11bca00c38c72125cd4a51091e13685375ba4426fb59dc/requests-2.15.1.tar.gz over the one in the Streamlink folder fixed this issue for me,  but I still would like to not have to do this every time I install the latest nightly
That's strange, I cannot reproduce that warning. Could you re-download the latest nightly, uninstall and reinstall it. I used [streamlink-0.6.0-20170603.exe](https://bintray.com/streamlink/streamlink-nightly/download_file?file_path=streamlink-0.6.0-20170603.exe) (generated 6 hours ago), and I did not get the warning when playing a twitch stream.
Yep, uninstalling the old version and install that nightly works with no issue

I just deleted the files in the install directory, then installed the nightly to that directory.  On a side note, does uninstalling delete the config file in Appdata/Roaming?  I ask because I have written instructions for people on a twitch channel I mod to follow to install this.  I wanna know if I need to add a line about remaking the config file if it is deleted when uninstalling.
I haven't encountered this issue since @beardypig suggested I uninstall and reinstall the nightly. Since then I have installed newer nightlies, without uninstalling, without any issues
@thinkpad4 Thanks for the update, are we good to close this out then?

Edit: Hit close and comment instead of just comment like an idiot.
And using the latest Nightly [cli][info] Found matching plugin twitch for URL twitch.tv/crream
[plugin.twitch][info] Attempting to authenticate using OAuth token
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRe
questWarning: Unverified HTTPS request is being made. Adding certificate verific
ation is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advance
d-usage.html#ssl-warnings
  InsecureRequestWarning)
[plugin.twitch][info] Successfully logged in as Thinkpad4
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRe
questWarning: Unverified HTTPS request is being made. Adding certificate verific
ation is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advance
d-usage.html#ssl-warnings
  InsecureRequestWarning)
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRe
questWarning: Unverified HTTPS request is being made. Adding certificate verific
ation is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advance
d-usage.html#ssl-warnings
  InsecureRequestWarning)
d:\Program Files (x86)\Streamlink\pkgs\urllib3\connectionpool.py:852: InsecureRe
questWarning: Unverified HTTPS request is being made. Adding certificate verific
ation is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advance
d-usage.html#ssl-warnings
  InsecureRequestWarning)
error: No playable streams found on this URL: twitch.tv/crream

Getting this again, it WAS working with the nightlies until today.  

Uninstalling did NOT work to resolve it this time.  It DID work the last time

 The certificate used by Twitch cannot be verified on some OpenSSL versions.
        res = http.get(url, params=params, verify=False, headers=headers) Might have to be made default to True to make sure this doesn't keep happening

Resolving patch:
diff --git a/src/streamlink/plugins/twitch.py b/src/streamlink/plugins/twitch.py
--- a/src/streamlink/plugins/twitch.py
+++ b/src/streamlink/plugins/twitch.py
@@ -203,8 +203,7 @@ def call(self, path, format="json", schema=None, **extra_params):
         headers = {'Accept': 'application/vnd.twitchtv.v{0}+json'.format(self.version),
                    'Client-ID': TWITCH_CLIENT_ID}
 
-        # The certificate used by Twitch cannot be verified on some OpenSSL versions.
-        res = http.get(url, params=params, verify=False, headers=headers)
+        res = http.get(url, params=params, headers=headers)
 
         if format == "json":
             return http.json(res, schema=schema)


Test patch: