SSL error with Python requests despite modern dependencies

Question

I get an SSL "bad handshake" error message. Most of the similar answers to this problem seem to come from old libraries, 1024bit cert. incompatibility etc. I think I am in the know and cannot understand why I am getting this error.

SETUP:

• requests 2.13.0
• certifi 2017.01.23
• 'OpenSSL 1.0.2g March 1, 2016

I use this API (key key is 2048 bits): https://api.sidecar.io/rest/v1/provision/application/device/count/

And get this error: requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)

See l.44 https://github.com/sidecar-io/sidecar-python-sdk/blob/master/sidecar.py

If I turn verify=False into requests, I can work around, but I would prefer to find out why certification fails.

Any help is appreciated; thanks!

Answer 1

The verification fails because the server you are accessing is not configured correctly, that is, it is not an error of your installation or code. Looking at the report from SSLLabs , you see

This server certificate chain is incomplete. Rank closed to B.

This means that the server sends a certificate chain that does not have an intermediate trusted root certificate, and thus your client cannot create a trust chain. Most desktop browsers work around this problem by trying to obtain a missing certificate from another location, but in this case the normal TLS libraries will fail. You will need to explicitly add the missing chain certificate as endowed to solve this problem:

 import requests requests.get('https://api.sidecar.io', verify = 'mycerts.pem') 

mycerts.pem must contain a missing intermediate certificate and a trusted root certificate. A verified version for mycerts.pem can be found at http://pastebin.com/aZSKfyb7 .

Answer 2

This may help in solving the problem.

 print(requests.get(url, proxies,verify = False))