I'm using requests to communicate with a django app but

When I try

requests.get('https://mysite.com', verify=True)

I get the error:

hostname 'mysite.com' doesn't match either of '*.myhost.com', 'myhost.com'

However, when I look at the browser, or http://www.digicert.com/help/ the certificate looks fine and dandy.

My host suggested it was the lack of SNI support from requests (and Github seems to confirm that https://github.com/kennethreitz/requests/issues/749 ). Has anyone found a work-around using requests?

share|improve this question
    
I edited Lukasa answer (the correct one) for a workaround to have SNI support in older requests in case you can't use the latest github version. Please ensure you have the required dependencies (not only the python ones, also openssl) installed in your system. It will be available once the edit is reviewed :) – AntonioMO Sep 4 '13 at 1:25
    
I think it's better creating a new answer rather than perform a redical edit in the post of someone – Lucas Eduardo Sep 4 '13 at 1:27
    
Well his answer is correct so I thought it wasn't nice to have another answer for another case, personally I really prefer one answer having all the info. But I'll post another answer then. – AntonioMO Sep 4 '13 at 16:00
    
Curious, what operating system were you using to test this? Hitting SNI hosts works for me with Ubuntu Precise but not Lucid, and I cannot figure out why. stackoverflow.com/questions/24522757/… – Joe Shaw Jul 2 '14 at 4:17
up vote 113 down vote accepted

The current version of Requests should be just fine with SNI. Further down the GitHub issue you can see the requirements:

Try installing those packages and then give it another shot.

EDIT: As of Requests v2.12.1, ndg-httpsclient and pyasn1 are no longer required. The full list of required packages is now:

  • pyOpenSSL
  • idna
share|improve this answer
3  
Thank you. I also saw this pull request github.com/kennethreitz/requests/pull/1347 which together with installing urllib3, ndg-httpsclient and pyasn1 solved it. – Massagran Sep 4 '13 at 15:59
    
The bug mentioned by @qarma is being tracked by issue 1732 and is already fixed in master. – Lukasa Nov 25 '13 at 16:24
4  
Is this fix still working? I get [Errno bad handshake] [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]. – Roman Jun 27 '14 at 9:24
1  
This fix absolutely is still working. Looks like the certificate isn't valid. – Lukasa Jun 27 '14 at 9:50
1  
Just so you know, your answer is referenced in this FAQ - at the end of the page. – Luís Cruz May 22 '15 at 21:50

In order for me to get the accepted answer to work, I had to install a bunch of other packages, in this order:

  • yum install libffi-devel
  • yum install gcc
  • yum install openssl-devel
  • pip install urllib3
  • pip install pyopenssl
  • pip install ndg-httpsclient
  • pip install pyasn1
share|improve this answer
2  
I also had to install: yum install python-devel before going to the pip installs.. – Kaos Jul 14 '15 at 9:02
    
Actually, for me, ndg-httpsclient installed all of those python packages except urllib3. Note to get a recent version of pip, though, or it won't work any how.. – Kaos Jul 14 '15 at 15:23
    
Why so many installation needed - just to user request() ? – ihue Nov 8 '16 at 15:55
    
@ihue These installations were needed years ago to get around the fact that the Python SSL module in the standard library didn't support SNI. That's no longer the case, and using the newest versions of Python 2 or 3 don't require these extra installs. – dpoggi Jan 9 '17 at 19:36

Install requests module like this. This will install the security package extras.

pip install requests[security]

share|improve this answer
1  
update pip before executing the above command. – xialu 2 days ago

Or you can just use Python 2.7.9 and up:

"The entirety of Python 3.4's ssl module has been backported for Python 2.7.9. See PEP 466 for justification."

https://www.python.org/downloads/release/python-279/

share|improve this answer
3  
I kept getting requests.exceptions.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:590) and I have Python 2.7.10 – ihue Nov 8 '16 at 15:54

@Lukasa answer is correct with the present (from github) requests. Remember to add OpenSSL in your system too apart from the pip dependencies he mentions.

If for deployment reasons you prefer a stable requests version like the 1.2.3 in pip, you can monkey patch that one to work with SNI like this:

import requests


def fileno(self):
    return self.socket.fileno()


def close(self):
    return self.connection.shutdown()


requests.pyopenssl.WrappedSocket.close = close
requests.pyopenssl.WrappedSocket.fileno = fileno
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.