{"action":"created","issue":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/2455","labels_url":"https://api.github.com/repos/kennethreitz/requests/issues/2455/labels{/name}","comments_url":"https://api.github.com/repos/kennethreitz/requests/issues/2455/comments","events_url":"https://api.github.com/repos/kennethreitz/requests/issues/2455/events","html_url":"https://github.com/kennethreitz/requests/issues/2455","id":58678665,"number":2455,"title":"CERTIFICATE_VERIFY_FAILED with 2.5.2, works with 2.5.1","user":{"login":"rmcgibbo","id":641278,"avatar_url":"https://avatars.githubusercontent.com/u/641278?v=3","gravatar_id":"","url":"https://api.github.com/users/rmcgibbo","html_url":"https://github.com/rmcgibbo","followers_url":"https://api.github.com/users/rmcgibbo/followers","following_url":"https://api.github.com/users/rmcgibbo/following{/other_user}","gists_url":"https://api.github.com/users/rmcgibbo/gists{/gist_id}","starred_url":"https://api.github.com/users/rmcgibbo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmcgibbo/subscriptions","organizations_url":"https://api.github.com/users/rmcgibbo/orgs","repos_url":"https://api.github.com/users/rmcgibbo/repos","events_url":"https://api.github.com/users/rmcgibbo/events{/privacy}","received_events_url":"https://api.github.com/users/rmcgibbo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":42,"created_at":"2015-02-24T01:11:01Z","updated_at":"2015-02-24T15:10:22Z","closed_at":null,"body":"I'm having a somewhat odd issue. A get() request seems to work fine with requests-2.5.1, but after upgrading to requests 2.5.2, the same URL leads to `CERTIFICATE_VERIFY_FAILED`. cc @mpharrigan\r\n\r\n```\r\n$ pip install requests==2.5.1\r\n[ ... snip, installs just fine ...]\r\n\r\n$ python -c 'import requests; print(requests.get(\"http://conda.binstar.org/omnia/linux-64/fftw3f-3.3.3-1.tar.bz2\"))'\r\n<Response [200]>\r\n\r\n$ pip install requests==2.5.2\r\n[ ... snip, installs just fine ...]\r\n\r\n$ python -c 'import requests; print(requests.get(\"http://conda.binstar.org/omnia/linux-64/fftw3f-3.3.3-1.tar.bz2\"))'\r\nTraceback (most recent call last):\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py\", line 544, in urlopen\r\n    body=body, headers=headers)\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py\", line 341, in _make_request\r\n    self._validate_conn(conn)\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py\", line 762, in _validate_conn\r\n    conn.connect()\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/site-packages/requests/packages/urllib3/connection.py\", line 238, in connect\r\n    ssl_version=resolved_ssl_version)\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/site-packages/requests/packages/urllib3/util/ssl_.py\", line 256, in ssl_wrap_socket\r\n    return context.wrap_socket(sock, server_hostname=server_hostname)\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/ssl.py\", line 364, in wrap_socket\r\n    _context=self)\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/ssl.py\", line 578, in __init__\r\n    self.do_handshake()\r\n  File \"/Users/rmcgibbo/miniconda/envs/3.4.2/lib/python3.4/ssl.py\", line 805, in do_handshake\r\n    self._sslobj.do_handshake()\r\nssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)\r\n\r\nDuring handling of the above exception, another exception occurred:\r\n[... snip ...]\r\n```"},"comment":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/comments/75773677","html_url":"https://github.com/kennethreitz/requests/issues/2455#issuecomment-75773677","issue_url":"https://api.github.com/repos/kennethreitz/requests/issues/2455","id":75773677,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2015-02-24T15:10:22Z","updated_at":"2015-02-24T15:10:22Z","body":"Ok, so a totally plain context exhibits exactly this bug:\r\n\r\n```python\r\nPython 2.7.8 (default, Jun 30 2014, 16:03:49) [MSC v.1500 32 bit (Intel)]\r\nType \"copyright\", \"credits\" or \"license\" for more information.\r\n\r\nIPython 2.2.0 -- An enhanced Interactive Python.\r\n?         -> Introduction and overview of IPython's features.\r\n%quickref -> Quick reference.\r\nhelp      -> Python's own help system.\r\nobject?   -> Details about 'object', use 'object??' for extra details.\r\n\r\nIn [1]: import socket\r\n\r\nIn [2]: import ssl\r\n\r\nIn [3]: s = socket.socket()\r\n\r\nIn [4]: s = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED, ca_certs='cacert.pem\r\n')\r\n\r\nIn [5]: s.connect(('binstar-cio-packages-prod.s3.amazonaws.com', 443))\r\n---------------------------------------------------------------------------\r\nSSLError                                  Traceback (most recent call last)\r\n<ipython-input-5-57fdd5d85aac> in <module>()\r\n----> 1 s.connect(('binstar-cio-packages-prod.s3.amazonaws.com', 443))\r\n\r\nC:\\Python27\\Lib\\ssl.pyc in connect(self, addr)\r\n    336         \"\"\"Connects to remote ADDR, and then wraps the connection in\r\n    337         an SSL channel.\"\"\"\r\n--> 338         self._real_connect(addr, False)\r\n    339\r\n    340     def connect_ex(self, addr):\r\n\r\nC:\\Python27\\Lib\\ssl.pyc in _real_connect(self, addr, return_errno)\r\n    326             if not rc:\r\n    327                 if self.do_handshake_on_connect:\r\n--> 328                     self.do_handshake()\r\n    329                 self._connected = True\r\n    330             return rc\r\n\r\nC:\\Python27\\Lib\\ssl.pyc in do_handshake(self)\r\n    308         \"\"\"Perform a TLS/SSL handshake.\"\"\"\r\n    309\r\n--> 310         self._sslobj.do_handshake()\r\n    311\r\n    312     def _real_connect(self, addr, return_errno):\r\n\r\nSSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERT\r\nIFICATE:certificate verify failed\r\n```\r\n\r\nNote that it doesn't apply to all certificates, as I can correctly connect to mkcert.org."}}