SSL failures, but it works in a browser

[davidread]

e.g. https://services.historicengland.org.uk/NMRDataDownload/default.aspx loads in Chrome, with a green padlock, yet it gives me SSL error in ckanext-archiver/requests:

>>> import requests
>>> requests.get('https://services.historicengland.org.uk/NMRDataDownload/default.aspx')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/co/ckan/local/lib/python2.7/site-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/home/co/ckan/local/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/home/co/ckan/local/lib/python2.7/site-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/co/ckan/local/lib/python2.7/site-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/home/co/ckan/local/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno bad handshake] [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]

Versions:

$ pip freeze | egrep -i 'requests\=|certifi\='
certifi==2016.2.28
requests==2.7.0
$ python -c "import ssl; print ssl.OPENSSL_VERSION"
OpenSSL 1.0.1 14 Mar 2012

[davidread]

This appears to be a problem with the OpenSSL version, since I get <Response [200]> on another environment:

$ python -c "import ssl; print ssl.OPENSSL_VERSION"
OpenSSL 0.9.8zh 14 Jan 2016