ssl-error with requests 2.20

[misterhsp]

Since the update of requests from 2.13 to 2.20 I get ssl errors and the syncserver doesn't start anymore.

Traceback (most recent call last): File "/usr/local/lib/python2.7/dist-packages/gunicorn/arbiter.py", line 557, in spawn_worker worker.init_process() File "/usr/local/lib/python2.7/dist-packages/gunicorn/workers/base.py", line 126, in init_process self.load_wsgi() File "/usr/local/lib/python2.7/dist-packages/gunicorn/workers/base.py", line 136, in load_wsgi self.wsgi = self.app.wsgi() File "/usr/local/lib/python2.7/dist-packages/gunicorn/app/base.py", line 67, in wsgi self.callable = self.load() File "/usr/local/lib/python2.7/dist-packages/gunicorn/app/wsgiapp.py", line 65, in load return self.load_wsgiapp() File "/usr/local/lib/python2.7/dist-packages/gunicorn/app/wsgiapp.py", line 52, in load_wsgiapp return util.import_app(self.app_uri) File "/usr/local/lib/python2.7/dist-packages/gunicorn/util.py", line 357, in import_app __import__(module) File "/home/fxa/syncserver/syncserver/wsgi_app.py", line 2, in <module> application = syncserver.main() File "/home/fxa/syncserver/syncserver/__init__.py", line 265, in main config = get_configurator(global_config, **settings) File "/home/fxa/syncserver/syncserver/__init__.py", line 257, in get_configurator config.include(includeme) File "/usr/local/lib/python2.7/dist-packages/pyramid/config/__init__.py", line 754, in include c(configurator) File "/home/fxa/syncserver/syncserver/__init__.py", line 66, in includeme r = requests.get(urljoin(idp, '/.well-known/fxa-client-configuration')) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 75, in get return request('get', url, params=params, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 60, in request return session.request(method=method, url=url, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 524, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 637, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 514, in send raise SSLError(e, request=request) SSLError: HTTPSConnectionPool(host='fxa.localhorst.home', port=3030): Max retries exceeded with url: /.well-known/fxa-client-configuration (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),)) [2018-11-04 22:16:54 +0000] [14] [INFO] Worker exiting (pid: 14)

Thanks...

[misterhsp]

I tried 2.13 again and everything worked out the way it was supposed to, weird. With 2.20 it comes again to the error.

...

[rfk]

Thanks for reporting this, unfortunately I'm not sure what's going on here. I wonder, could you please try installing some of the intermediate versions of requests in order to narrow down the change that is causing this? (For example, does it work or fail on 2.17? 2.19? The full history of release versions is here.)

[misterhsp]

I found the reason by trying it out. request 2.20 needs REQUESTS_CA_BUNDLE=/path/to/ca-bundle in my dockerinstall otherwise it finds nothing. Why that worked at 2.13 before without the variable is a mystery to me.

[rfk]

Is this something that's unique to your setup, or should we add a note in a readme somewhere here for others?

[misterhsp]

hmm, a little note won't hurt anyone :)