opened
jorourke
username_0
In trying to make a https connection as so:

```shell 
(trustmile-api-p2710)jBeast:trustmile james$ python -c "import requests; r = requests.get('https://devapi.trustmile.com/static/index.html', verify=True)"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/api.py", line 67, in get
    return request('get', url, params=params, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/api.py", line 53, in request
    return session.request(method=method, url=url, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/Users/james/.virtualenvs/trustmile-api-p2710/lib/python2.7/site-packages/requests/adapters.py", line 447, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)
```

I have latest necessary packages installed:

```shell
(trustmile-api-p2710)jBeast:trustmile james$ pip freeze | egrep '(requests|urllib3|certifi)'
certifi==2015.11.20.1
requests==2.9.1
urllib3==1.14
```

However, urllib works in the same environment:

```python
import urllib3
import certifi

http = urllib3.PoolManager(
    cert_reqs='CERT_REQUIRED', # Force certificate check.
    ca_certs=certifi.where(),  # Path to the Certifi bundle.
)

# You're ready to make verified HTTPS requests.
try:
    r = http.request('GET', 'https://devapi.trustmile.com/static/index.html')
    print r.status
except urllib3.exceptions.SSLError as e:
    print e
```  
Output is status 200.

Am I missing something? I tried to set the relevant environment variables. The cert is a legit one and it's root cert is in the cacerts.pem in certifi package. 

Thanks again for an awesome package I use all the time Kenneth et al!
Inconsistent behaviour with https between urllib3 and requestsion. 
issue
created
Lukasa
username_1
Out of interest, what version of OpenSSL are you using? Run `python -c 'import ssl; print ssl.OPENSSL_VERSION'`
comment
created
jorourke
username_0
OpenSSL 0.9.8zg 14 July 2015
comment
created
Lukasa
username_1
Interesting. Does this problem occur if you don't pass `verify=True`?
comment
created
jorourke
username_0
Yep, same issue
comment
created
Lukasa
username_1
Hmm. What other packages do you have installed?
comment
created
jorourke
username_0
Ah, that must be it, created a clean env with just certifi, requests, and urllib3 in it. Will investigate further. I have a lot installed.
comment
created
jorourke
username_0
ok, fixed in my env. Not sure which was the culprit but this worked
```shell
pip uninstall backports.ssl-match-hostname
pip uninstall pyOpenSSL
````
comment
created
Lukasa
username_1
Yeah, so PyOpenSSL is the likely culprit. Requests, unlike urllib3, will automatically try to use PyOpenSSL if it's present. Can you reinstall it, and then run your urllib3 script with these two lines added to the top:

```python
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
```
comment
created
Lukasa
username_1
Your script would look like this:

```python
import urllib3
import urllib3.contrib.pyopenssl
import certifi

urllib3.contrib.pyopenssl.inject_into_urllib3()

http = urllib3.PoolManager(
    cert_reqs='CERT_REQUIRED', # Force certificate check.
    ca_certs=certifi.where(),  # Path to the Certifi bundle.
)

# You're ready to make verified HTTPS requests.
try:
    r = http.request('GET', 'https://devapi.trustmile.com/static/index.html')
    print r.status
except urllib3.exceptions.SSLError as e:
    print e
```
comment
closed
Lukasa
username_1
issue