Issue Type

Bug Report

Ansible Version

2.0.0 (devel 132c14e)

OS

OSX Yosemite (tested module file with pyenv against 2.7.8/2.7.9/2.7.10)

Summary

I've just encountered an issue with get_url on Github URLs, which are failing to verify certificates for some versions of Python. I'm fairly sure it's a manifestation of urllib3/urllib3#385, which describes potentially breaking changes to ._tunnel() in Python 3.4.1, backported to Python 2.7.9+. This logic seems to be identical to the connect method in lib/ansible/module_utils/urls.py, and behaves similarly -- the error I'm encountering is:

hostname 'webproxy.uhnres.utoronto.ca' doesn't match either of 'github.com', 'www.github.com'

The same URL can be requested just fine through browsers and curl, so it seems to be a Python-specific (and version-specific, it does not affect Python 2.7.8) certificate verification issue with proxies.

I think the modified logic in urllib3/urllib3#385 (comment) needs to be rolled into the connect method, so that self._tunnel_host is used in place of self.host if needed.

This is deep into the guts of various systems, and I'm not a Python person, but I'll make a PR if you want me to.

Steps to reproduce

This task should do it, if you have a proxy. All that matters is HTTPS + Github + Python 2/7/9+

- name: Webapp | Get release files
  get_url:
    url: "https://github.com/pughlab/tracker/releases/download/2.0.1-RC4/tracker-java-restlet-2.0.1-RC4.war"
    dest: "output.war"

Expected Results

Successful download

Actual Results

{"msg": "hostname 'webproxy.uhnres.utoronto.ca' doesn't match either of 'github.com', 'www.github.com'", "failed": true}