Repository: urllib3/urllib3

Issue:
urllib3 should not log an error on certificate mismatch
Logging an error and then reraising the exception does not achieve much as the application code will have to handle the exception anyway. It's better to let the application decide if it's a noteworthy event or not.

I personally don't think that a certificate mismatch is different from a server not responding or the other dozens of failures that can happen while marking an HTTP request (where urllib3 does not log an error).

In my case the "error" is reported to Sentry but there is nothing I can do as a client to fix it, which is usually a pretty good indicator that the log level should be changed to something else. If it was up to me I would change it to an `info` level.

https://github.com/urllib3/urllib3/blob/2c055b4a60affa3529660b928fff375fde3993f7/src/urllib3/connection.py#L428-L440

Discussion:
codecov-io: # [Codecov](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=h1) Report
> Merging [#1657](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=desc) into [master](https://codecov.io/gh/urllib3/urllib3/commit/5b047b645f5f93900d5e2fc31230848c25eb1f5f?src=pr&el=desc) will **not change** coverage.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/urllib3/urllib3/pull/1657/graphs/tree.svg?width=650&token=UYKHB2uXDn&height=150&src=pr)](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master    #1657   +/-   ##
=======================================
  Coverage   99.49%   99.49%           
=======================================
  Files          22       22           
  Lines        1967     1967           
=======================================
  Hits         1957     1957           
  Misses         10       10
```


| [Impacted Files](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [src/urllib3/connection.py](https://codecov.io/gh/urllib3/urllib3/pull/1657/diff?src=pr&el=tree#diff-c3JjL3VybGxpYjMvY29ubmVjdGlvbi5weQ==) | `93.75% <100%> (ø)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=footer). Last update [5b047b6...c858ad9](https://codecov.io/gh/urllib3/urllib3/pull/1657?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
index a138bb2a..86b9198a 100644
--- a/src/urllib3/connection.py
+++ b/src/urllib3/connection.py
@@ -429,7 +429,7 @@ def _match_hostname(cert, asserted_hostname):
     try:
         match_hostname(cert, asserted_hostname)
     except CertificateError as e:
-        log.error(
+        log.warning(
             "Certificate did not match expected hostname: %s. " "Certificate: %s",
             asserted_hostname,
             cert,


Test patch:
diff --git a/test/test_connection.py b/test/test_connection.py
index 5969a089..77794898 100644
--- a/test/test_connection.py
+++ b/test/test_connection.py
@@ -32,7 +32,7 @@ class TestConnection(object):
         cert = {"subjectAltName": [("DNS", "foo")]}
         asserted_hostname = "bar"
         try:
-            with mock.patch("urllib3.connection.log.error") as mock_log:
+            with mock.patch("urllib3.connection.log.warning") as mock_log:
                 _match_hostname(cert, asserted_hostname)
         except CertificateError as e:
             assert "hostname 'bar' doesn't match 'foo'" in str(e)