You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Due to the changes in this PR that made it into release 2.24.0 our stack went from using TLS 1.3 through pyopenssl to TLS 1.2 through the new requests/ssl path that is forced when ssl has SNI. This occurs when using Python 3.6.10.
Expected Result
On Python 3.6.10 with pyopenssl installed requests should use the highest TLS available, 1.3 (from pyopenssl), not 1.2 (from ssl).
Note: this really isn't a blocker for us at all since we are currently upgrading from Python 3.6.10 -> 3.7 which fixes the issue since the 3.7 ssl has TLS 1.3 support. But for any users using Python 3.6.10 there may be unexpected consequences from this update.
The text was updated successfully, but these errors were encountered:
Thanks for bringing this up! I don't think we'd taken this into account when pushing pyopenssl to the background. You can still opt into using pyopenssl on 3.6 with:
from urllib3.contrib import pyopenssl
pyopenssl.inject_into_urllib3()
It may be worth adding some kind of messaging around a potential TLS downgrade but I don't know if a warning is too invasive.
Due to the changes in this PR that made it into release 2.24.0 our stack went from using TLS 1.3 through
pyopenssl
to TLS 1.2 through the new requests/ssl
path that is forced whenssl
has SNI. This occurs when using Python 3.6.10.Expected Result
On Python 3.6.10 with
pyopenssl
installed requests should use the highest TLS available, 1.3 (frompyopenssl
), not 1.2 (fromssl
).Actual Result
On Python 3.6.10 TLS 1.2 is being used from
ssl
.Reproduction Steps
You can run the above easily from py36/py37 to observe the difference using conda:
conda create -n py36-test requests=2.24.0 python=3.6.10 pyopenssl=19.10.1
conda create -n py37-test requests=2.24.0 python=3.7 pyopenssl=19.10.1
System Information
Note: this really isn't a blocker for us at all since we are currently upgrading from Python 3.6.10 -> 3.7 which fixes the issue since the 3.7 ssl has TLS 1.3 support. But for any users using Python 3.6.10 there may be unexpected consequences from this update.
The text was updated successfully, but these errors were encountered: