This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Issue with ssl package
Type: behavior Stage:
Components: Library (Lib) Versions: Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: alex, christian.heimes, dstufft, giampaolo.rodola, janssen, kxl561, pitrou
Priority: normal Keywords:

Created on 2015-07-01 13:40 by kxl561, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Messages (3)
msg246037 - (view) Author: Kayne (kxl561) Date: 2015-07-01 13:40
I tried to use cert = ssl.get_server_certificate((XXXX, 443)) and it crashed with following error:

Traceback (most recent call last):
  File "PeerCertChainQuery.py", line 107, in <module>
    cert = ssl.get_server_certificate((options.host, 443))
  File "/opt/lib/python2.7/ssl.py", line 965, in get_server_certificate
    with closing(context.wrap_socket(sock)) as sslsock:
  File "/opt/lib/python2.7/ssl.py", line 350, in wrap_socket
    _context=self)
  File "/opt/lib/python2.7/ssl.py", line 566, in __init__
    self.do_handshake()
  File "/opt/lib/python2.7/ssl.py", line 788, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:581)

Note that the configuration of apache server on the host XXXX has disabled ssl3 support and it only supports TLSV1, TLVS1.1, AND TLSV1.3.

This also happened on Python 3.4.3. 

    Much appreciated if you could have a look at what happened or suggest me how to get around this.
msg246042 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2015-07-01 18:37
We should probably change the default value for the *ssl_version* parameter.
In the meantime, you can workaround this simply with:

cert = ssl.get_server_certificate((XXXX, 443), ssl.PROTOCOL_SSLv23)
msg275048 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-09-08 15:26
It will be fix in 2.7.13 as part of my OpenSSL 1.1.0 patch.
History
Date User Action Args
2022-04-11 14:58:18adminsetgithub: 68733
2016-09-08 15:26:50christian.heimessetstatus: open -> closed
resolution: fixed
messages: + msg275048
2015-07-01 18:37:11pitrousetmessages: + msg246042
2015-07-01 15:42:32skrahsettype: crash -> behavior
2015-07-01 13:56:01christian.heimessetnosy: + janssen, pitrou, giampaolo.rodola, christian.heimes, alex, dstufft
2015-07-01 13:40:52kxl561create