Disable SSL Verification

[rosenberg12]

I have a problem. The problem is that I got the following error

WARNING:urllib3.connectionpool:Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)'))': /v2/shipments.

Is there any option to deactive the ssl?

!pip install easypost
import os
import easypost
easypost.api_key = <app_key>
shipment = easypost.Shipment.create(
    from_address = {
        "name": "EasyPost",
        "street1": "118 2nd Street",
        "street2": "4th Floor",
        "city": "San Francisco",
        "state": "CA",
        "zip": "94105",
        "country": "US",
        "phone": "415-456-7890",
    },
    to_address = {
        "name": "Dr. Steve Brule",
        "street1": "179 N Harbor Dr",
        "city": "Redondo Beach",
        "state": "CA",
        "zip": "90277",
        "country": "US",
        "phone": "310-808-5243",
    },
    parcel = {
        "length": 10.2,
        "width": 7.8,
        "height": 4.3,
        "weight": 21.2,
    },
)
shipment.buy(rate=shipment.lowest_rate())
print(shipment)

Complete Log

WARNING:urllib3.connectionpool:Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)'))': /v2/shipments
WARNING:urllib3.connectionpool:Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)'))': /v2/shipments
WARNING:urllib3.connectionpool:Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)'))': /v2/shipments
---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:703, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    702 # Make the request on the httplib connection object.
--> 703 httplib_response = self._make_request(
    704     conn,
    705     method,
    706     url,
    707     timeout=timeout_obj,
    708     body=body,
    709     headers=headers,
    710     chunked=chunked,
    711 )
    713 # If we're going to release the connection in ``finally:``, then
    714 # the response doesn't need to know about the connection. Otherwise
    715 # it will also try to release it and we'll have a double-release
    716 # mess.

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:386, in HTTPConnectionPool._make_request(self, conn, method, url, timeout, chunked, **httplib_request_kw)
    385 try:
--> 386     self._validate_conn(conn)
    387 except (SocketTimeout, BaseSSLError) as e:
    388     # Py2 raises this as a BaseSSLError, Py3 raises it as socket timeout.

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:1040, in HTTPSConnectionPool._validate_conn(self, conn)
   1039 if not getattr(conn, "sock", None):  # AppEngine might not have  `.sock`
-> 1040     conn.connect()
   1042 if not conn.is_verified:

File ~\Anaconda3\lib\site-packages\urllib3\connection.py:414, in HTTPSConnection.connect(self)
    412     context.load_default_certs()
--> 414 self.sock = ssl_wrap_socket(
    415     sock=conn,
    416     keyfile=self.key_file,
    417     certfile=self.cert_file,
    418     key_password=self.key_password,
    419     ca_certs=self.ca_certs,
    420     ca_cert_dir=self.ca_cert_dir,
    421     ca_cert_data=self.ca_cert_data,
    422     server_hostname=server_hostname,
    423     ssl_context=context,
    424     tls_in_tls=tls_in_tls,
    425 )
    427 # If we're using all defaults and the connection
    428 # is TLSv1 or TLSv1.1 we throw a DeprecationWarning
    429 # for the host.

File ~\Anaconda3\lib\site-packages\urllib3\util\ssl_.py:449, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls)
    448 if send_sni:
--> 449     ssl_sock = _ssl_wrap_socket_impl(
    450         sock, context, tls_in_tls, server_hostname=server_hostname
    451     )
    452 else:

File ~\Anaconda3\lib\site-packages\urllib3\util\ssl_.py:493, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname)
    492 if server_hostname:
--> 493     return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
    494 else:

File ~\Anaconda3\lib\ssl.py:500, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    494 def wrap_socket(self, sock, server_side=False,
    495                 do_handshake_on_connect=True,
    496                 suppress_ragged_eofs=True,
    497                 server_hostname=None, session=None):
    498     # SSLSocket class handles server_hostname encoding before it calls
    499     # ctx._wrap_socket()
--> 500     return self.sslsocket_class._create(
    501         sock=sock,
    502         server_side=server_side,
    503         do_handshake_on_connect=do_handshake_on_connect,
    504         suppress_ragged_eofs=suppress_ragged_eofs,
    505         server_hostname=server_hostname,
    506         context=self,
    507         session=session
    508     )

File ~\Anaconda3\lib\ssl.py:1040, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1039             raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1040         self.do_handshake()
   1041 except (OSError, ValueError):

File ~\Anaconda3\lib\ssl.py:1309, in SSLSocket.do_handshake(self, block)
   1308         self.settimeout(None)
-> 1309     self._sslobj.do_handshake()
   1310 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)

During handling of the above exception, another exception occurred:

MaxRetryError                             Traceback (most recent call last)
File ~\Anaconda3\lib\site-packages\requests\adapters.py:440, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    439 if not chunked:
--> 440     resp = conn.urlopen(
    441         method=request.method,
    442         url=url,
    443         body=request.body,
    444         headers=request.headers,
    445         redirect=False,
    446         assert_same_host=False,
    447         preload_content=False,
    448         decode_content=False,
    449         retries=self.max_retries,
    450         timeout=timeout
    451     )
    453 # Send the request.
    454 else:

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:813, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    810     log.warning(
    811         "Retrying (%r) after connection broken by '%r': %s", retries, err, url
    812     )
--> 813     return self.urlopen(
    814         method,
    815         url,
    816         body,
    817         headers,
    818         retries,
    819         redirect,
    820         assert_same_host,
    821         timeout=timeout,
    822         pool_timeout=pool_timeout,
    823         release_conn=release_conn,
    824         chunked=chunked,
    825         body_pos=body_pos,
    826         **response_kw
    827     )
    829 # Handle redirect?

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:813, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    810     log.warning(
    811         "Retrying (%r) after connection broken by '%r': %s", retries, err, url
    812     )
--> 813     return self.urlopen(
    814         method,
    815         url,
    816         body,
    817         headers,
    818         retries,
    819         redirect,
    820         assert_same_host,
    821         timeout=timeout,
    822         pool_timeout=pool_timeout,
    823         release_conn=release_conn,
    824         chunked=chunked,
    825         body_pos=body_pos,
    826         **response_kw
    827     )
    829 # Handle redirect?

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:813, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    810     log.warning(
    811         "Retrying (%r) after connection broken by '%r': %s", retries, err, url
    812     )
--> 813     return self.urlopen(
    814         method,
    815         url,
    816         body,
    817         headers,
    818         retries,
    819         redirect,
    820         assert_same_host,
    821         timeout=timeout,
    822         pool_timeout=pool_timeout,
    823         release_conn=release_conn,
    824         chunked=chunked,
    825         body_pos=body_pos,
    826         **response_kw
    827     )
    829 # Handle redirect?

File ~\Anaconda3\lib\site-packages\urllib3\connectionpool.py:785, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, **response_kw)
    783     e = ProtocolError("Connection aborted.", e)
--> 785 retries = retries.increment(
    786     method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
    787 )
    788 retries.sleep()

File ~\Anaconda3\lib\site-packages\urllib3\util\retry.py:592, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    591 if new_retry.is_exhausted():
--> 592     raise MaxRetryError(_pool, url, error or ResponseError(cause))
    594 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='api.easypost.com', port=443): Max retries exceeded with url: /v2/shipments (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)')))

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
File ~\Anaconda3\lib\site-packages\easypost\requestor.py:222, in Requestor.requests_request(self, method, abs_url, headers, params)
    221 try:
--> 222     result = requests_session.request(
    223         method=method.value,
    224         url=abs_url,
    225         params=url_params,
    226         headers=headers,
    227         json=body,
    228         timeout=timeout,
    229         verify=True,
    230     )
    231     http_body = result.text

File ~\Anaconda3\lib\site-packages\requests\sessions.py:529, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    528 send_kwargs.update(settings)
--> 529 resp = self.send(prep, **send_kwargs)
    531 return resp

File ~\Anaconda3\lib\site-packages\requests\sessions.py:645, in Session.send(self, request, **kwargs)
    644 # Send the request
--> 645 r = adapter.send(request, **kwargs)
    647 # Total elapsed time of the request (approximately)

File ~\Anaconda3\lib\site-packages\requests\adapters.py:517, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    515 if isinstance(e.reason, _SSLError):
    516     # This branch is for urllib3 v1.22 and later.
--> 517     raise SSLError(e, request=request)
    519 raise ConnectionError(e, request=request)

SSLError: HTTPSConnectionPool(host='api.easypost.com', port=443): Max retries exceeded with url: /v2/shipments (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)')))

During handling of the above exception, another exception occurred:

Error                                     Traceback (most recent call last)
Input In [52], in <cell line: 6>()
      2 import easypost
      4 easypost.api_key = <apikey>
----> 6 shipment = easypost.Shipment.create(
      7     from_address = {
      8         "name": "EasyPost",
      9         "street1": "118 2nd Street",
     10         "street2": "4th Floor",
     11         "city": "San Francisco",
     12         "state": "CA",
     13         "zip": "94105",
     14         "country": "US",
     15         "phone": "415-456-7890",
     16     },
     17     to_address = {
     18         "name": "Dr. Steve Brule",
     19         "street1": "179 N Harbor Dr",
     20         "city": "Redondo Beach",
     21         "state": "CA",
     22         "zip": "90277",
     23         "country": "US",
     24         "phone": "310-808-5243",
     25     },
     26     parcel = {
     27         "length": 10.2,
     28         "width": 7.8,
     29         "height": 4.3,
     30         "weight": 21.2,
     31     },
     32 )
     34 shipment.buy(rate=shipment.lowest_rate())
     36 print(shipment)

File ~\Anaconda3\lib\site-packages\easypost\shipment.py:32, in Shipment.create(cls, api_key, with_carbon_offset, **params)
     27 url = cls.class_url()
     28 wrapped_params = {
     29     cls.snakecase_name(): params,
     30     "carbon_offset": with_carbon_offset,
     31 }
---> 32 response, api_key = requestor.request(method=RequestMethod.POST, url=url, params=wrapped_params)
     33 return convert_to_easypost_object(response=response, api_key=api_key)

File ~\Anaconda3\lib\site-packages\easypost\requestor.py:91, in Requestor.request(self, method, url, params, api_key_required, beta)
     89 if params is None:
     90     params = {}
---> 91 http_body, http_status, my_api_key = self.request_raw(
     92     method=method,
     93     url=url,
     94     params=params,
     95     api_key_required=api_key_required,
     96     beta=beta,
     97 )
     98 response = self.interpret_response(http_body=http_body, http_status=http_status)
     99 return response, my_api_key

File ~\Anaconda3\lib\site-packages\easypost\requestor.py:177, in Requestor.request_raw(self, method, url, params, api_key_required, beta)
    173     http_body, http_status = self.urlfetch_request(
    174         method=method, abs_url=abs_url, headers=headers, params=params
    175     )
    176 elif request_lib == "requests":
--> 177     http_body, http_status = self.requests_request(
    178         method=method, abs_url=abs_url, headers=headers, params=params
    179     )
    180 else:
    181     raise Error(f"Bug discovered: invalid request_lib: {request_lib}. Please report to {SUPPORT_EMAIL}.")

File ~\Anaconda3\lib\site-packages\easypost\requestor.py:234, in Requestor.requests_request(self, method, abs_url, headers, params)
    232     http_status = result.status_code
    233 except Exception as e:
--> 234     raise Error(
    235         "Unexpected error communicating with EasyPost. If this "
    236         f"problem persists please let us know at {SUPPORT_EMAIL}.",
    237         original_exception=e,
    238     )
    239 return http_body, http_status

Error: Unexpected error communicating with EasyPost. If this problem persists please let us know at support@easypost.com.

[rosenberg12]

I changed inside the requestor.py the verify. So I set verify=True to verify=False .
But that deliveries me ValueError: Cannot set verify_mode to CERT_NONE when check_hostname is enabled.

I also tried to disable check_hostname with

import ssl
import urllib.request

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

[Justintime50]

There is not currently an option to disable SSL verification as this could lead to man-in-the-middle attacks and is not something we will support. If you absolutely need this, you could of course disable it by setting verify=False in the code and building from source like you have.

It sounds like you have a local invalid or self-signed certificate on the computer you are running your code from, is that correct? If so, the best fix is to actually fix the certificate issue (outside the scope of the support we can provide here). I also noticed you are running Anaconda, how did you install our library?

Finally, per the issue template for this project which you did not use, we need more information to assist. What kind of request were you making (appears to be a Shipment create request)? What version of the library is in use? What steps can we try to recreate the issue (does this happen on every request or just some)? Based on the file paths in what you shared, it looks like you are running this on Windows, is that correct?

[rosenberg12]

Thank you for the answer. verify = False returns another error and that is ValueError: Cannot set verify_mode to CERT_NONE when check_hostname is enabled..
I installed the library under Anconda with pip install easypost.
I have the following requirements:

• Request shipment.buy(rate=shipment.lowest_rate()) (example code see above)
• Windows 10
• Anaconda conda 4.13.0
• Python 3.9.7

[Justintime50]

Disabling the check_hostname is not something that the requests library lets you do natively. You would need to build a urllib wrapper to be able to do this. Some potential resources:

• https://stackoverflow.com/a/22794281/6064135
• https://stackoverflow.com/a/33770290/6064135

As this issue falls outside the scope of our library and is related with the urllib/requests libraries, I'm going to close it. I would highly encourage fixing the SSL issue at the root instead of trying to disable it as it's an insecure method of working with APIs. Otherwise hopefully some of the above StackOverflow questions should point you in the right direction. Alternatively you could raise an issue on their GitHub pages instead on how to properly do this. Best of luck!