requests.exceptions.SSLError：SSL：TLSV1_ALERT_PROTOCOL_VERSION]的TLSv1警報協議版本（_ssl.c：590）

Question

我試圖訪問一個網站，請求包這樣

page = requests.get('https://jobregister.aas.org') 

，但我得到以下

Traceback (most recent call last): 
    File "daily.py", line 453, in <module> 
    main() 
    File "/Users/xflorian/github/benty-fields/app/functions.py", line 1450, in 
loopup 
    page = requests.get('https://jobregister.aas.org') 
    File "/Library/Python/2.7/site-packages/requests/api.py", line 72, in get 
    return request('get', url, params=params, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/api.py", line 58, in request 
    return session.request(method=method, url=url, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/sessions.py", line 518, in request 
    resp = self.send(prep, **send_kwargs) 
    File "/Library/Python/2.7/site-packages/requests/sessions.py", line 639, in send 
    r = adapter.send(request, **kwargs) 
    File "/Library/Python/2.7/site-packages/requests/adapters.py", line 512, in send 
    raise SSLError(e, request=request) 
requests.exceptions.SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:590) 

我一派錯誤，看到的是，如果使用，或者TLS1.2不支持舊版本的OpenSSL會發生這種情況。所以我查了一下，該網站似乎支持TLS1.2，我使用openssl 1.02。

任何想法我應該檢查什麼？

Answer 1

I am trying to access a website with the requests package like this

page = requests.get('https://jobregister.aas.org') 

您需要使用TLS 1.2或TLS 1.1（和SNI）。我猜站點配置爲AEAD密碼，如AES/GCM：

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1_2 
CONNECTED(00000003) 
depth=1 C = IL, O = StartCom Ltd., OU = StartCom Certification Authority, CN = StartCom Class 2 IV Server CA 
verify error:num=20:unable to get local issuer certificate 
--- 
Certificate chain 
0 s:/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org 
    i:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
1 s:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
    i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority 
--- 
Server certificate 
-----BEGIN CERTIFICATE----- 
MIIFITCCBAmgAwIBAgIQGbs3057U/Syz4sykElT6DTANBgkqhkiG9w0BAQsFADB4 
MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMg 
U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJjAkBgNVBAMTHVN0YXJ0 
Q29tIENsYXNzIDIgSVYgU2VydmVyIENBMB4XDTE2MDIxMDE5NTU1NFoXDTE4MDIx 
MDE5NTU1NFowYTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRMwEQYD 
VQQHDApBbGV4YW5kcmlhMRYwFAYDVQQKDA1KdXN0aW4gTWFjaWFrMRIwEAYDVQQD 
DAkqLmFhcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPgFwS 
QN2lyx6WN7T4cFmuWyrukIAVJPBZl/i/8IwZxckc0C91ANAkiHurkWBJfEZBVf+m 
r7Hmin8sHcHUhDKs4UqIHBAgY7e2B2yGOCOJxa6O6SrhMhkirKZw1IYA5lXPgH2v 
DMRB7rRoveDHWZ08k1f5R4FncShvA69iY0Dljmrd4AR2Xjf4nbLvh0ChAgFhrjbA 
yBJtp3RMSVsBI8TNnne7qFK9dlPr3mDIQbXf4mngc0Uv6igADWQBqoqx8jexuMSw 
3fedHXXqePRlD2SdK/rAJ5d3CYPn9/oq2HauUqt487U9mzvwR+nx27SZJPK2p79r 
ijRfF+uWSa2orTZNAgMBAAGjggG8MIIBuDALBgNVHQ8EBAMCBaAwHQYDVR0lBBYw 
FAYIKwYBBQUHAwIGCCsGAQUFBwMBMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFr4gOvu 
PEOaTy8KtAHgEo4WIRtDMB8GA1UdIwQYMBaAFJTehUEqpdlF9mAsLkyTCaYsI34+ 
MG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRz 
c2wuY29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0 
cy9zY2Euc2VydmVyMi5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5z 
dGFydHNzbC5jb20vc2NhLXNlcnZlcjIuY3JsMB0GA1UdEQQWMBSCCSouYWFzLm9y 
Z4IHYWFzLm9yZzAjBgNVHRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8w 
UAYDVR0gBEkwRzAIBgZngQwBAgMwOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEFBQcC 
ARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUA 
A4IBAQBQNjXQhR3BBbNjo0rO4kcTQKTwwf0+wfH19+bncRGJGmKByk24fXdXhAd7 
w1btui3k03tFTvrbhnebBQZTazQ+CltgLAoMQBojuav6T1NSyIfT2iH6LjfKIaup 
t0SXXsXvW5uhuYvrMiX87i7IYvK9kPy5jBB3FxcSrU8V1wSQk1O6XEXepFsCYIK+ 
YWat41++zBjiRscNEcuxrtr71c+5JTR1ll15QZgVrcYn4Be1/lATmlT2lz3qH+Eq 
WNCgJ1u1lutRBsxAGerq4oTQb678BguxkFMeXE2Nlp9sqjZgpCDHCk3biPhiL0+M 
uggZlya+HNoKuF5K3SXsRI2UWyxE 
-----END CERTIFICATE----- 
subject=/C=US/ST=Virginia/L=Alexandria/O=Justin Maciak/CN=*.aas.org 
issuer=/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA 
--- 
No client certificate CA names sent 
Peer signing digest: SHA512 
Server Temp Key: ECDH, P-256, 256 bits 
--- 
SSL handshake has read 3523 bytes and written 461 bytes 
--- 
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 
Server public key is 2048 bit 
Secure Renegotiation IS supported 
No ALPN negotiated 
SSL-Session: 
    Protocol : TLSv1.2 
    Cipher : ECDHE-RSA-AES256-GCM-SHA384 
    Session-ID: 84A3C288DAFBD182DE3DEB23F75B237840195CFC448B8133B81F66141ABD301D 
    Session-ID-ctx: 
    Master-Key: B8B828351678142AF6FBE8033DEEFE2C0F7B0357D5438CE800CE5E59E55859188F4B5EEDB395B8D90D8854A434B2D566 
    Key-Arg : None 
    PSK identity: None 
    PSK identity hint: None 
    SRP username: None 
    TLS session ticket lifetime hint: 86400 (seconds) 
    TLS session ticket: 
    0000 - 13 ed d6 60 e2 71 8a 93-9f 1b d4 5a a3 cd 13 e3 ...`.q.....Z.... 
    0010 - 54 7e 3d 08 e8 83 0b f9-8e b2 61 02 c0 20 c8 f8 T~=.......a.. .. 
    0020 - 22 a4 65 f7 89 dd 9e f9-e8 14 16 97 ec b8 ac ec ".e............. 
    0030 - b1 a1 7f 86 a8 94 2b 75-47 2c f4 0e 5f e9 db 8e ......+uG,.._... 
    0040 - d1 db 52 30 0b 52 24 4c-14 ea dd 3e 64 d5 ee 06 ..R0.R$L...>d... 
    0050 - 0d 9d 3e 99 f7 fe ef 71-8b a7 39 88 6b cc be ee ..>....q..9.k... 
    0060 - 44 6f b5 0b 08 0d c4 6e-18 d3 23 9c 32 40 b9 f2 Do.....n..#.2@.. 
    0070 - 7a 1d 7a fa ef 3d b4 0a-d6 c8 39 2c 6f 88 b7 d6 z.z..=....9,o... 
    0080 - 31 93 5a 30 6a 0b cf 96-69 f4 b0 45 24 2c 00 f0 1.Z0j...i..E$,.. 
    0090 - 5f 4e 24 8e 17 a4 b6 e1-67 7b 69 a5 cb 03 d6 b2 _N$.....g{i..... 
    00a0 - 44 a1 e5 10 1a 86 75 68-53 0f eb 91 ca 90 82 b5 D.....uhS....... 
    00b0 - 58 9c 5c 0a a7 fc 50 1b-ee 99 1f 5a 23 99 4f 15 X.\...P....Z#.O. 

    Start Time: 1498974907 
    Timeout : 7200 (sec) 
    Verify return code: 20 (unable to get local issuer certificate) 

TLS 1.0被拒絕（-tls1選項）：

$ openssl s_client -connect jobregister.aas.org:443 -servername jobregister.aas.org -tls1 
CONNECTED(00000003) 
140022080839192:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70 
140022080839192:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659: 

---

您可以修復Verify return code: 20 (unable to get local issuer certificate)通過使用-CAfile選項並從StartCom Root CA Certificates提供StartCom CA Root。

---

I'm guessing the site is configured for the AEAD ciphers, like AES/GCM:

哎呦，這是錯誤的。它看起來是TLS 1.1或1.2，但它包含多個密碼套件不僅僅是AEAD的：

$ sslscan --no-failed jobregister.aas.org 
    ... 

    Supported Server Cipher(s): 
    Accepted TLS11 256 bits ECDHE-RSA-AES256-SHA 
    Accepted TLS11 256 bits DHE-RSA-AES256-SHA 
    Accepted TLS11 256 bits DHE-RSA-CAMELLIA256-SHA 
    Accepted TLS11 128 bits ECDHE-RSA-AES128-SHA 
    Accepted TLS11 128 bits DHE-RSA-AES128-SHA 
    Accepted TLS11 128 bits DHE-RSA-SEED-SHA 
    Accepted TLS11 128 bits DHE-RSA-CAMELLIA128-SHA 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 
    Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA 
    Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384 
    Accepted TLS12 256 bits DHE-RSA-AES256-SHA256 
    Accepted TLS12 256 bits DHE-RSA-AES256-SHA 
    Accepted TLS12 256 bits DHE-RSA-CAMELLIA256-SHA 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 
    Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA 
    Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256 
    Accepted TLS12 128 bits DHE-RSA-AES128-SHA256 
    Accepted TLS12 128 bits DHE-RSA-AES128-SHA 
    Accepted TLS12 128 bits DHE-RSA-SEED-SHA 
    Accepted TLS12 128 bits DHE-RSA-CAMELLIA128-SHA 

---

(comment) How would I need to modify the requests command?

在OpenSSL的正確，你將使用CTX_set_options or SSL_CTX_set_options截至SSL/TLS Client對OpenSSL的維基詳細。

如果我正確（我可能不是）解析Python的OpenSSL的手冊和3.3.1 Context objects，然後調用set_options刪除SSLv2，SSLv3和TLSv1。根據3.3 SSL - An interface to the SSL-specific parts of OpenSSL，您可以使用OP_NO_SSLv2,OP_NO_SSLv3和OP_NO_TLSv1。