requests.exceptions.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] TLSv1 alerte version du protocole (_ssl.c: 590)

Question

Je suis en train d'accéder à un site Web avec le paquet demandes comme celui-ci

page = requests.get('https://jobregister.aas.org') 

mais je reçois le texte suivant

Traceback (most recent call last): 
    File "daily.py", line 453, in <module> 
    main() 
    File "/Users/xflorian/github/benty-fields/app/functions.py", line 1450, in 
loopup 
    page = requests.get('https://jobregister.aas.org') 
    File "/Library/Python/2.7/site-packages/requests/api.py", line 72, in get 
    return request('get', url, params=params, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/api.py", line 58, in request 
    return session.request(method=method, url=url, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/sessions.py", line 518, in request 
    resp = self.send(prep, **send_kwargs) 
    File "/Library/Python/2.7/site-packages/requests/sessions.py", line 639, in send 
    r = adapter.send(request, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/adapters.py", line 512, in send 
    raise SSLError(e, request=request) 
requests.exceptions.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:590) 

Je googlé l'erreur et a vu que cela peut se produire si une ancienne version de OpenSSL est utilisée ou si TLS1.2 n'est pas pris en charge. J'ai donc vérifié et le site semble prendre en charge TLS1.2 et j'utilise openssl 1.02.

Une idée de quoi d'autre que je devrais vérifier?

Answer 1

I am trying to access a website with the requests package like this

page = requests.get('https://jobregister.aas.org') 

Vous devez utiliser TLS 1.2 ou TLS 1.1 (et SNI). Je devine que le site est configuré pour les chiffrements AEAD, comme AES/GCM:

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1_2 
CONNECTED(00000003) 
depth=1 C = IL, O = StartCom Ltd., OU = StartCom Certification Authority, CN = StartCom Class 2 IV Server CA 
verify error:num=20:unable to get local issuer certificate 
--- 
Certificate chain 
0 s:/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org 
    i:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
1 s:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
    i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority 
--- 
Server certificate 
-----BEGIN CERTIFICATE----- 
MIIFITCCBAmgAwIBAgIQGbs3057U/Syz4sykElT6DTANBgkqhkiG9w0BAQsFADB4 
MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMg 
U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJjAkBgNVBAMTHVN0YXJ0 
Q29tIENsYXNzIDIgSVYgU2VydmVyIENBMB4XDTE2MDIxMDE5NTU1NFoXDTE4MDIx 
MDE5NTU1NFowYTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRMwEQYD 
VQQHDApBbGV4YW5kcmlhMRYwFAYDVQQKDA1KdXN0aW4gTWFjaWFrMRIwEAYDVQQD 
DAkqLmFhcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPgFwS 
QN2lyx6WN7T4cFmuWyrukIAVJPBZl/i/8IwZxckc0C91ANAkiHurkWBJfEZBVf+m 
r7Hmin8sHcHUhDKs4UqIHBAgY7e2B2yGOCOJxa6O6SrhMhkirKZw1IYA5lXPgH2v 
DMRB7rRoveDHWZ08k1f5R4FncShvA69iY0Dljmrd4AR2Xjf4nbLvh0ChAgFhrjbA 
yBJtp3RMSVsBI8TNnne7qFK9dlPr3mDIQbXf4mngc0Uv6igADWQBqoqx8jexuMSw 
3fedHXXqePRlD2SdK/rAJ5d3CYPn9/oq2HauUqt487U9mzvwR+nx27SZJPK2p79r 
ijRfF+uWSa2orTZNAgMBAAGjggG8MIIBuDALBgNVHQ8EBAMCBaAwHQYDVR0lBBYw 
FAYIKwYBBQUHAwIGCCsGAQUFBwMBMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFr4gOvu 
PEOaTy8KtAHgEo4WIRtDMB8GA1UdIwQYMBaAFJTehUEqpdlF9mAsLkyTCaYsI34+ 
MG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRz 
c2wuY29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0 
cy9zY2Euc2VydmVyMi5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5z 
dGFydHNzbC5jb20vc2NhLXNlcnZlcjIuY3JsMB0GA1UdEQQWMBSCCSouYWFzLm9y 
Z4IHYWFzLm9yZzAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8w 
UAYDVR0gBEkwRzAIBgZngQwBAgMwOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEFBQcC 
ARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUA 
A4IBAQBQNjXQhR3BBbNjo0rO4kcTQKTwwf0+wfH19+bncRGJGmKByk24fXdXhAd7 
w1btui3k03tFTvrbhnebBQZTazQ+CltgLAoMQBojuav6T1NSyIfT2iH6LjfKIaup 
t0SXXsXvW5uhuYvrMiX87i7IYvK9kPy5jBB3FxcSrU8V1wSQk1O6XEXepFsCYIK+ 
YWat41++zBjiRscNEcuxrtr71c+5JTR1ll15QZgVrcYn4Be1/lATmlT2lz3qH+Eq 
WNCgJ1u1lutRBsxAGerq4oTQb678BguxkFMeXE2Nlp9sqjZgpCDHCk3biPhiL0+M 
uggZlya+HNoKuF5K3SXsRI2UWyxE 
-----END CERTIFICATE----- 
subject=/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org 
issuer=/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
--- 
No client certificate CA names sent 
Peer signing digest: SHA512 
Server Temp Key: ECDH, P-256, 256 bits 
--- 
SSL handshake has read 3523 bytes and written 461 bytes 
--- 
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 
Server public key is 2048 bit 
Secure Renegotiation IS supported 
No ALPN negotiated 
SSL-Session: 
    Protocol : TLSv1.2 
    Cipher : ECDHE-RSA-AES256-GCM-SHA384 
    Session-ID: 84A3C288DAFBD182DE3DEB23F75B237840195CFC448B8133B81F66141ABD301D 
    Session-ID-ctx: 
    Master-Key: B8B828351678142AF6FBE8033DEEFE2C0F7B0357D5438CE800CE5E59E55859188F4B5EEDB395B8D90D8854A434B2D566 
    Key-Arg : None 
    PSK identity: None 
    PSK identity hint: None 
    SRP username: None 
    TLS session ticket lifetime hint: 86400 (seconds) 
    TLS session ticket: 
    0000 - 13 ed d6 60 e2 71 8a 93-9f 1b d4 5a a3 cd 13 e3 ...`.q.....Z.... 
    0010 - 54 7e 3d 08 e8 83 0b f9-8e b2 61 02 c0 20 c8 f8 T~=.......a.. .. 
    0020 - 22 a4 65 f7 89 dd 9e f9-e8 14 16 97 ec b8 ac ec ".e............. 
    0030 - b1 a1 7f 86 a8 94 2b 75-47 2c f4 0e 5f e9 db 8e ......+uG,.._... 
    0040 - d1 db 52 30 0b 52 24 4c-14 ea dd 3e 64 d5 ee 06 ..R0.R$L...>d... 
    0050 - 0d 9d 3e 99 f7 fe ef 71-8b a7 39 88 6b cc be ee ..>....q..9.k... 
    0060 - 44 6f b5 0b 08 0d c4 6e-18 d3 23 9c 32 40 b9 f2 Do.....n..#.2@.. 
    0070 - 7a 1d 7a fa ef 3d b4 0a-d6 c8 39 2c 6f 88 b7 d6 z.z..=....9,o... 
    0080 - 31 93 5a 30 6a 0b cf 96-69 f4 b0 45 24 2c 00 f0 1.Z0j...i..E$,.. 
    0090 - 5f 4e 24 8e 17 a4 b6 e1-67 7b 69 a5 cb 03 d6 b2 _N$.....g{i..... 
    00a0 - 44 a1 e5 10 1a 86 75 68-53 0f eb 91 ca 90 82 b5 D.....uhS....... 
    00b0 - 58 9c 5c 0a a7 fc 50 1b-ee 99 1f 5a 23 99 4f 15 X.\...P....Z#.O. 

    Start Time: 1498974907 
    Timeout : 7200 (sec) 
    Verify return code: 20 (unable to get local issuer certificate) 

TLS 1.0 a été rejetée (en option -tls1):

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1 
CONNECTED(00000003) 
140022080839192:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70 
140022080839192:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659: 

---

Vous pouvez fixer le Verify return code: 20 (unable to get local issuer certificate) en utilisant l'option -CAfile et en fournissant la racine CA StartCom à partir de StartCom Root CA Certificates.

---

I'm guessing the site is configured for the AEAD ciphers, like AES/GCM:

Whoops, cela était faux. On dirait qu'il est TLS 1.1 ou 1.2, mais il comprend plus de suites de chiffrement que seulement ceux AEAD:

$ sslscan --no-failed jobregister.aas.org 
    ... 

    Supported Server Cipher(s): 
    Accepted TLS11 256 bits ECDHE-RSA-AES256-SHA 
    Accepted TLS11 256 bits DHE-RSA-AES256-SHA 
    Accepted TLS11 256 bits DHE-RSA-CAMELLIA256-SHA 
    Accepted TLS11 128 bits ECDHE-RSA-AES128-SHA 
    Accepted TLS11 128 bits DHE-RSA-AES128-SHA 
    Accepted TLS11 128 bits DHE-RSA-SEED-SHA 
    Accepted TLS11 128 bits DHE-RSA-CAMELLIA128-SHA 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA 
    Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384 
    Accepted TLS12 256 bits DHE-RSA-AES256-SHA256 
    Accepted TLS12 256 bits DHE-RSA-AES256-SHA 
    Accepted TLS12 256 bits DHE-RSA-CAMELLIA256-SHA 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA 
    Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256 
    Accepted TLS12 128 bits DHE-RSA-AES128-SHA256 
    Accepted TLS12 128 bits DHE-RSA-AES128-SHA 
    Accepted TLS12 128 bits DHE-RSA-SEED-SHA 
    Accepted TLS12 128 bits DHE-RSA-CAMELLIA128-SHA 

---

(comment) How would I need to modify the requests command?

En OpenSSL bon vous utiliseriez CTX_set_options or SSL_CTX_set_options comme détaillé à SSL/TLS Client sur le wiki OpenSSL .

Si je suis analyse du manuel OpenSSL Python et 3.3.1 Context objects correctement (que je ne peux être), vous appelez set_options pour enlever SSLv2, SSLv3 et TLSv1. Selon 3.3 SSL - An interface to the SSL-specific parts of OpenSSL vous utiliseriez OP_NO_SSLv2, OP_NO_SSLv3 et OP_NO_TLSv1.