requests.exceptions.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:590)

Question

I am trying to access a website with the requests package like this

page = requests.get('https://jobregister.aas.org')

but I get the following

Traceback (most recent call last):
  File "daily.py", line 453, in <module>
    main()
  File "/Users/xflorian/github/benty-fields/app/functions.py", line 1450, in 
loopup
    page = requests.get('https://jobregister.aas.org')
  File "/Library/Python/2.7/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/Library/Python/2.7/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/Library/Python/2.7/site-packages/requests/sessions.py", line 518, in request
    resp = self.send(prep, **send_kwargs)
  File "/Library/Python/2.7/site-packages/requests/sessions.py", line 639, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Python/2.7/site-packages/requests/adapters.py", line 512, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:590)

I googled the error and saw that this can happen if an old openssl version is used or if TLS1.2 is not supported. So I checked and the website seems to support TLS1.2 and I use openssl 1.02.

Any idea what else I should check?

Answer 1

I am trying to access a website with the requests package like this

 page = requests.get('https://jobregister.aas.org') 

You need to use TLS 1.2 or TLS 1.1 (and SNI). I'm guessing the site is configured for the AEAD ciphers, like AES/GCM:

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1_2
CONNECTED(00000003)
depth=1 C = IL, O = StartCom Ltd., OU = StartCom Certification Authority, CN = StartCom Class 2 IV Server CA
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org
   i:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA
 1 s:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA
   i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFITCCBAmgAwIBAgIQGbs3057U/Syz4sykElT6DTANBgkqhkiG9w0BAQsFADB4
MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMg
U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJjAkBgNVBAMTHVN0YXJ0
Q29tIENsYXNzIDIgSVYgU2VydmVyIENBMB4XDTE2MDIxMDE5NTU1NFoXDTE4MDIx
MDE5NTU1NFowYTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRMwEQYD
VQQHDApBbGV4YW5kcmlhMRYwFAYDVQQKDA1KdXN0aW4gTWFjaWFrMRIwEAYDVQQD
DAkqLmFhcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPgFwS
QN2lyx6WN7T4cFmuWyrukIAVJPBZl/i/8IwZxckc0C91ANAkiHurkWBJfEZBVf+m
r7Hmin8sHcHUhDKs4UqIHBAgY7e2B2yGOCOJxa6O6SrhMhkirKZw1IYA5lXPgH2v
DMRB7rRoveDHWZ08k1f5R4FncShvA69iY0Dljmrd4AR2Xjf4nbLvh0ChAgFhrjbA
yBJtp3RMSVsBI8TNnne7qFK9dlPr3mDIQbXf4mngc0Uv6igADWQBqoqx8jexuMSw
3fedHXXqePRlD2SdK/rAJ5d3CYPn9/oq2HauUqt487U9mzvwR+nx27SZJPK2p79r
ijRfF+uWSa2orTZNAgMBAAGjggG8MIIBuDALBgNVHQ8EBAMCBaAwHQYDVR0lBBYw
FAYIKwYBBQUHAwIGCCsGAQUFBwMBMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFr4gOvu
PEOaTy8KtAHgEo4WIRtDMB8GA1UdIwQYMBaAFJTehUEqpdlF9mAsLkyTCaYsI34+
MG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRz
c2wuY29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0
cy9zY2Euc2VydmVyMi5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5z
dGFydHNzbC5jb20vc2NhLXNlcnZlcjIuY3JsMB0GA1UdEQQWMBSCCSouYWFzLm9y
Z4IHYWFzLm9yZzAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8w
UAYDVR0gBEkwRzAIBgZngQwBAgMwOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEFBQcC
ARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUA
A4IBAQBQNjXQhR3BBbNjo0rO4kcTQKTwwf0+wfH19+bncRGJGmKByk24fXdXhAd7
w1btui3k03tFTvrbhnebBQZTazQ+CltgLAoMQBojuav6T1NSyIfT2iH6LjfKIaup
t0SXXsXvW5uhuYvrMiX87i7IYvK9kPy5jBB3FxcSrU8V1wSQk1O6XEXepFsCYIK+
YWat41++zBjiRscNEcuxrtr71c+5JTR1ll15QZgVrcYn4Be1/lATmlT2lz3qH+Eq
WNCgJ1u1lutRBsxAGerq4oTQb678BguxkFMeXE2Nlp9sqjZgpCDHCk3biPhiL0+M
uggZlya+HNoKuF5K3SXsRI2UWyxE
-----END CERTIFICATE-----
subject=/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org
issuer=/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3523 bytes and written 461 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 84A3C288DAFBD182DE3DEB23F75B237840195CFC448B8133B81F66141ABD301D
    Session-ID-ctx:
    Master-Key: B8B828351678142AF6FBE8033DEEFE2C0F7B0357D5438CE800CE5E59E55859188F4B5EEDB395B8D90D8854A434B2D566
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 86400 (seconds)
    TLS session ticket:
    0000 - 13 ed d6 60 e2 71 8a 93-9f 1b d4 5a a3 cd 13 e3   ...`.q.....Z....
    0010 - 54 7e 3d 08 e8 83 0b f9-8e b2 61 02 c0 20 c8 f8   T~=.......a.. ..
    0020 - 22 a4 65 f7 89 dd 9e f9-e8 14 16 97 ec b8 ac ec   ".e.............
    0030 - b1 a1 7f 86 a8 94 2b 75-47 2c f4 0e 5f e9 db 8e   ......+uG,.._...
    0040 - d1 db 52 30 0b 52 24 4c-14 ea dd 3e 64 d5 ee 06   ..R0.R$L...>d...
    0050 - 0d 9d 3e 99 f7 fe ef 71-8b a7 39 88 6b cc be ee   ..>....q..9.k...
    0060 - 44 6f b5 0b 08 0d c4 6e-18 d3 23 9c 32 40 b9 f2   Do.....n..#.2@..
    0070 - 7a 1d 7a fa ef 3d b4 0a-d6 c8 39 2c 6f 88 b7 d6   z.z..=....9,o...
    0080 - 31 93 5a 30 6a 0b cf 96-69 f4 b0 45 24 2c 00 f0   1.Z0j...i..E$,..
    0090 - 5f 4e 24 8e 17 a4 b6 e1-67 7b 69 a5 cb 03 d6 b2   _N$.....g{i.....
    00a0 - 44 a1 e5 10 1a 86 75 68-53 0f eb 91 ca 90 82 b5   D.....uhS.......
    00b0 - 58 9c 5c 0a a7 fc 50 1b-ee 99 1f 5a 23 99 4f 15   X.\...P....Z#.O.

    Start Time: 1498974907
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)

TLS 1.0 was rejected ( -tls1 option):

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1
CONNECTED(00000003)
140022080839192:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70
140022080839192:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:

---

You can fix the Verify return code: 20 (unable to get local issuer certificate) by using the -CAfile option and providing the StartCom CA Root from StartCom Root CA Certificates .

---

I'm guessing the site is configured for the AEAD ciphers, like AES/GCM:

Whoops, this was wrong. It looks like it is TLS 1.1 or 1.2, but it includes more cipher suites than just the AEAD ones:

$ sslscan --no-failed jobregister.aas.org
  ...

  Supported Server Cipher(s):
    Accepted  TLS11  256 bits  ECDHE-RSA-AES256-SHA
    Accepted  TLS11  256 bits  DHE-RSA-AES256-SHA
    Accepted  TLS11  256 bits  DHE-RSA-CAMELLIA256-SHA
    Accepted  TLS11  128 bits  ECDHE-RSA-AES128-SHA
    Accepted  TLS11  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLS11  128 bits  DHE-RSA-SEED-SHA
    Accepted  TLS11  128 bits  DHE-RSA-CAMELLIA128-SHA
    Accepted  TLS12  256 bits  ECDHE-RSA-AES256-GCM-SHA384
    Accepted  TLS12  256 bits  ECDHE-RSA-AES256-SHA384
    Accepted  TLS12  256 bits  ECDHE-RSA-AES256-SHA
    Accepted  TLS12  256 bits  DHE-RSA-AES256-GCM-SHA384
    Accepted  TLS12  256 bits  DHE-RSA-AES256-SHA256
    Accepted  TLS12  256 bits  DHE-RSA-AES256-SHA
    Accepted  TLS12  256 bits  DHE-RSA-CAMELLIA256-SHA
    Accepted  TLS12  128 bits  ECDHE-RSA-AES128-GCM-SHA256
    Accepted  TLS12  128 bits  ECDHE-RSA-AES128-SHA256
    Accepted  TLS12  128 bits  ECDHE-RSA-AES128-SHA
    Accepted  TLS12  128 bits  DHE-RSA-AES128-GCM-SHA256
    Accepted  TLS12  128 bits  DHE-RSA-AES128-SHA256
    Accepted  TLS12  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLS12  128 bits  DHE-RSA-SEED-SHA
    Accepted  TLS12  128 bits  DHE-RSA-CAMELLIA128-SHA

---

(comment) How would I need to modify the requests command?

In OpenSSL proper you would use CTX_set_options or SSL_CTX_set_options as detailed at SSL/TLS Client on the OpenSSL wiki.

If I am parsing the Python OpenSSL Manual and 3.3.1 Context objects correctly (which I may not be), then you call set_options to remove SSLv2 , SSLv3 , and TLSv1 . According to 3.3 SSL - An interface to the SSL-specific parts of OpenSSL you would use OP_NO_SSLv2 , OP_NO_SSLv3 and OP_NO_TLSv1 .