This is a manifestation of an incompatibility between recent versions of OpenSSL and certain Web servers. Apple's doing their best to eliminate OpenSSL on OS X, so they're only applying security patches (OpenSSL has been difficult to support as part of the OS, not to mention "minor" updates introducing issues like this one), whereas Debian is using a more recent OpenSSL 1.0.1.
@Brian Redbeard’s suggestion to check with the openssl
command-line is a good one — it hung for me on wwws.mint.com
when I just tried it.
This question on ServerFault finally provided the answer. The SSLLabs test linked there identifies long handshake intolerance as the issue, which affects OpenSSL 1.0.1 and later, and links to an OpenSSL bug with some potential workarounds.
Either using -no_tls1_2
, as one of the OpenSSL developers recommends, or reducing the cipher list with the -cipher
argument, causes OpenSSL 1.0.1 to successfully handshake with wwws.mint.com
(as well as another server I was trying to contact).
For my purposes — a script that isn't going to be distributed — I monkeypatched ssl.wrap_socket
as follows:
import ssl
old_wrap_socket = ssl.wrap_socket
def wrap_socket(sock, keyfile=None, certfile=None,
server_side=False, cert_reqs=ssl.CERT_NONE,
ssl_version=ssl.PROTOCOL_SSLv3, ca_certs=None,
do_handshake_on_connect=True,
suppress_ragged_eofs=True, ciphers=None):
return old_wrap_socket(sock, keyfile, certfile,
server_side, cert_reqs, ssl_version,
ca_certs, do_handshake_on_connect,
suppress_ragged_eofs, ciphers)
ssl.wrap_socket = wrap_socket
import mechanize
The default value for ssl_version
is ssl.PROTOCOL_SSLv23
; by changing it to PROTOCOL_SSLv3
it successfully connects.
You could guard this patch using a test such as ssl.OPENSSL_VERSION_INFO[:3] >= (1, 0, 1)
.
This should likely be reported as a Debian OpenSSL bug if it hasn't been already.