Client certificates broken since 2023.6.2

[kaptajnen]

Issue description

Since version 2023.6.2, pipenv no longer works with repositories requiring the use of client certificate authentication. Even when supplying the PIP_CLIENT_CERT environment variable, I am getting certificate errors when running e.g. pipenv lock -d. Furthermore, it appears the verify_ssl option in the Pipfile is ignored. I had to add the REQUESTS_CA_BUNDLE environment variable to fix this, but I assume this should be considered a bug as well.

Expected result

No errors

Actual result

$ pipenv lock -d --verbose
Loading .env environment variables...
Locking [packages] dependencies...
Building requirements...
Resolving dependencies...
Reporter.starting()
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting()
Reporter.adding_requirement(SpecifierRequirement('requests'), None)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.adding_requirement(SpecifierRequirement('requests'), None)
Reporter.starting_round(0)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(0)
Reporter.adding_requirement(SpecifierRequirement('charset-normalizer<4,>=2'), LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.adding_requirement(SpecifierRequirement('charset-normalizer<4,>=2'),
LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
Reporter.adding_requirement(SpecifierRequirement('idna<4,>=2.5'), LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.adding_requirement(SpecifierRequirement('idna<4,>=2.5'),
LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
Reporter.adding_requirement(SpecifierRequirement('urllib3<3,>=1.21.1'), LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.adding_requirement(SpecifierRequirement('urllib3<3,>=1.21.1'),
LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
Reporter.adding_requirement(SpecifierRequirement('certifi>=2017.4.17'), LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.adding_requirement(SpecifierRequirement('certifi>=2017.4.17'),
LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))
Reporter.ending_round(0, state)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending_round(0, state)
Reporter.starting_round(1)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(1)
Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/9d/19/59961b522e6757f0c9097e4493fa906031b95b3ebe9360b2c3083561a6b4/certifi-2023.5.7-py3-none-any.whl#sha256=c6c2e98f5c7869efca1f8916fed228dd91539f9f1b444c314c06eef02980c716 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/certifi/) (requires-python:>=3.6)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/9d/19/59961b522e6757f0c9097e4493fa906031b95b3ebe9360b2c3083561a6b4/certifi-2023.5.7-py3-none-any.whl#sha256=c6c2e98f5c7869efca1f8916fed228dd91539f9f1b444c314c06eef02980c716 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/certifi/) (requires-python:>=3.6)'))
Reporter.ending_round(1, state)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending_round(1, state)
Reporter.starting_round(2)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(2)
Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/d5/92/86c0f0e66e897f6818c46dadef328a5b345d061688f9960fc6ca1fd03dbe/charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl#sha256=6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/charset-normalizer/)
(requires-python:>=3.7.0)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/d5/92/86c0f0e66e897f6818c46dadef328a5b345d061688f9960fc6ca1fd03dbe/charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl#sha256=6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/charset-normalizer/) (requires-python:>=3.7.0)'))
Reporter.ending_round(2, state)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending_round(2, state)
Reporter.starting_round(3)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(3)
Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/fc/34/3030de6f1370931b9dbb4dad48f6ab1015ab1d32447850b9fc94e60097be/idna-3.4-py3-none-any.whl#sha256=90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/idna/) (requires-python:>=3.5)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/fc/34/3030de6f1370931b9dbb4dad48f6ab1015ab1d32447850b9fc94e60097be/idna-3.4-py3-none-any.whl#sha256=90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/idna/) (requires-python:>=3.5)'))
Reporter.ending_round(3, state)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending_round(3, state)
Reporter.starting_round(4)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(4)
Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/8a/03/ad9306a50d05c166e3456fe810f33cee2b8b2a7a6818ec5d4908c4ec6b36/urllib3-2.0.3-py3-none-any.whl#sha256=48e7fafa40319d358848e1bc6809b208340fafe2096f1725d05d67443d0483d1 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/urllib3/) (requires-python:>=3.7)'))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.pinning(LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/8a/03/ad9306a50d05c166e3456fe810f33cee2b8b2a7a6818ec5d4908c4ec6b36/urllib3-2.0.3-py3-none-any.whl#sha256=48e7fafa40319d358848e1bc6809b208340fafe2096f1725d05d67443d0483d1 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/urllib3/) (requires-python:>=3.7)'))
Reporter.ending_round(4, state)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending_round(4, state)
Reporter.starting_round(5)
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.starting_round(5)
Reporter.ending(State(mapping=OrderedDict([('requests', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/)
(requires-python:>=3.7)')), ('certifi', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/9d/19/59961b522e6757f0c9097e4493fa906031b95b3ebe9360b2c3083561a6b4/certifi-2023.5.7-py3-none-any.whl#sha256=c6c2e98f5c7869efca1f8916fed228dd91539f9f1b444c314c06eef02980c716 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/certifi/)
(requires-python:>=3.6)')), ('charset-normalizer', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/d5/92/86c0f0e66e897f6818c46dadef328a5b345d061688f9960fc6ca1fd03dbe/charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl#sha256=6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/charset-normalizer/) (requires-python:>=3.7.0)')), ('idna', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/fc/34/3030de6f1370931b9dbb4dad48f6ab1015ab1d32447850b9fc94e60097be/idna-3.4-py3-none-any.whl#sha256=90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/idna/) (requires-python:>=3.5)')), ('urllib3', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/8a/03/ad9306a50d05c166e3456fe810f33cee2b8b2a7a6818ec5d4908c4ec6b36/urllib3-2.0.3-py3-none-any.whl#sha256=48e7fafa40319d358848e1bc6809b208340fafe2096f1725d05d67443d0483d1 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/urllib3/) (requires-python:>=3.7)'))]), criteria={'requests': Criterion((SpecifierRequirement('requests'), via=None)), 'charset-normalizer': Criterion((SpecifierRequirement('charset-normalizer<4,>=2'),
via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))), 'idna':
Criterion((SpecifierRequirement('idna<4,>=2.5'), via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/)
(requires-python:>=3.7)'))), 'urllib3': Criterion((SpecifierRequirement('urllib3<3,>=1.21.1'), via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))), 'certifi': Criterion((SpecifierRequirement('certifi>=2017.4.17'),
via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)')))}, backtrack_causes=[]))
INFO:pipenv.patched.pip._internal.resolution.resolvelib.reporter:Reporter.ending(State(mapping=OrderedDict([('requests', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f
(from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)')), ('certifi', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/9d/19/59961b522e6757f0c9097e4493fa906031b95b3ebe9360b2c3083561a6b4/certifi-2023.5.7-py3-none-any.whl#sha256=c6c2e98f5c7869efca1f8916fed228dd91539f9f1b444c314c06eef02980c716 (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/certifi/) (requires-python:>=3.6)')), ('charset-normalizer',
LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/d5/92/86c0f0e66e897f6818c46dadef328a5b345d061688f9960fc6ca1fd03dbe/charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl#sha256=6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/charset-normalizer/)
(requires-python:>=3.7.0)')), ('idna', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/fc/34/3030de6f1370931b9dbb4dad48f6ab1015ab1d32447850b9fc94e60097be/idna-3.4-py3-none-any.whl#sha256=90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/idna/) (requires-python:>=3.5)')),
('urllib3', LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/8a/03/ad9306a50d05c166e3456fe810f33cee2b8b2a7a6818ec5d4908c4ec6b36/urllib3-2.0.3-py3-none-any.whl#sha256=48e7fafa40319d358848e1bc6809b208340fafe2096f1725d05d67443d0483d1 (from https://<REDACTED>/api/pypi/<REDACTED>/simple/urllib3/) (requires-python:>=3.7)'))]),
criteria={'requests': Criterion((SpecifierRequirement('requests'), via=None)), 'charset-normalizer': Criterion((SpecifierRequirement('charset-normalizer<4,>=2'),
via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))), 'idna':
Criterion((SpecifierRequirement('idna<4,>=2.5'), via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/)
(requires-python:>=3.7)'))), 'urllib3': Criterion((SpecifierRequirement('urllib3<3,>=1.21.1'), via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from
https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)'))), 'certifi': Criterion((SpecifierRequirement('certifi>=2017.4.17'),
via=LinkCandidate('https://<REDACTED>/api/pypi/<REDACTED>/packages/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f (from https://<REDACTED>/api/pypi/<REDACTED>/simple/requests/) (requires-python:>=3.7)')))}, backtrack_causes=[]))
Traceback (most recent call last):
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/connectionpool.py", line 703, in urlopen
    httplib_response = self._make_request(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/connectionpool.py", line 386, in _make_request
    self._validate_conn(conn)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/connectionpool.py", line 1042, in _validate_conn
    conn.connect()
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/connection.py", line 419, in connect
    self.sock = ssl_wrap_socket(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/local/Cellar/python@3.9/3.9.17/Frameworks/Python.framework/Versions/3.9/lib/python3.9/ssl.py", line 501, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/local/Cellar/python@3.9/3.9.17/Frameworks/Python.framework/Versions/3.9/lib/python3.9/ssl.py", line 1041, in _create
    self.do_handshake()
  File "/usr/local/Cellar/python@3.9/3.9.17/Frameworks/Python.framework/Versions/3.9/lib/python3.9/ssl.py", line 1310, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1129)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/requests/adapters.py", line 489, in send
    resp = conn.urlopen(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/connectionpool.py", line 787, in urlopen
    retries = retries.increment(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
pipenv.patched.pip._vendor.urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='<REDACTED>', port=443): Max retries exceeded with url: /api/pypi/<REDACTED>/simple/charset-normalizer/ (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1129)')))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/resolver.py", line 845, in <module>
    main()
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/resolver.py", line 831, in main
    _main(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/resolver.py", line 811, in _main
    resolve_packages(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/resolver.py", line 759, in resolve_packages
    results, resolver = resolve(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/resolver.py", line 738, in resolve
    return resolve_deps(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 1154, in resolve_deps
    results, hashes, markers_lookup, resolver, skipped = actually_resolve_deps(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 954, in actually_resolve_deps
    hashes = resolver.resolve_hashes()
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 855, in resolve_hashes
    self.hashes = self.collect_hashes(ireq)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 835, in collect_hashes
    hashes = self._get_hashes_from_remote_index_urls(ireq, source)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 783, in _get_hashes_from_remote_index_urls
    response = session.get(pkg_url, timeout=10)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/requests/sessions.py", line 600, in get
    return self.request("GET", url, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/requests/sessions.py", line 587, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/requests/sessions.py", line 701, in send
    r = adapter.send(request, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/patched/pip/_vendor/requests/adapters.py", line 563, in send
    raise SSLError(e, request=request)
pipenv.patched.pip._vendor.requests.exceptions.SSLError: HTTPSConnectionPool(host='<REDACTED>', port=443): Max retries exceeded with url: /api/pypi/<REDACTED>/simple/charset-normalizer/ (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1129)')))
✘ Locking Failed!
⠼ Locking...
Traceback (most recent call last):
  File "/Users/jlaursen/.local/bin/pipenv", line 8, in <module>
    sys.exit(cli())
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/cli/options.py", line 58, in main
    return super().main(*args, **kwargs, windows_expand_args=False)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/decorators.py", line 84, in new_func
    return ctx.invoke(f, obj, *args, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/vendor/click/decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/cli/command.py", line 369, in lock
    do_lock(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/routines/lock.py", line 79, in do_lock
    venv_resolve_deps(
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 1096, in venv_resolve_deps
    c = resolve(cmd, st, project=project)
  File "/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv/utils/resolver.py", line 990, in resolve
    raise RuntimeError("Failed to lock Pipfile.lock!")
RuntimeError: Failed to lock Pipfile.lock!

Steps to replicate

Not sure how you can test this if you don't have a python package repository testing environment with client certificate auth.

---

$ pipenv --support

Pipenv version: '2023.6.2'

Pipenv location: '/Users/jlaursen/.local/lib/python3.8/site-packages/pipenv'

Python location: '/Users/jlaursen/.pyenv/versions/3.8.7/bin/python3.8'

OS Name: 'posix'

User pip version: '20.2.3'

user Python installations found:

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.8.7',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '22.5.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 22.5.0: Mon Apr 24 20:51:50 PDT '
                     '2023; root:xnu-8796.121.2~5/RELEASE_X86_64',
 'python_full_version': '3.8.7',
 'python_version': '3.8',
 'sys_platform': 'darwin'}

System environment variables:

• PWD
• PYENV_ROOT
• fish_user_paths
• LOGNAME
• SHELL
• __CFBundleIdentifier
• SECURITYSESSIONID
• LaunchInstanceID
• ALACRITTY_WINDOW_ID
• WINDOWID
• HOME
• __CF_USER_TEXT_ENCODING
• XPC_SERVICE_NAME
• PATH
• OLDPWD
• XPC_FLAGS
• ALACRITTY_LOG
• VIRTUAL_ENV_DISABLE_PROMPT
• TERM
• TMPDIR
• EDITOR
• COLORTERM
• LC_ALL
• ALACRITTY_SOCKET
• COMMAND_MODE
• SHLVL
• SSH_AUTH_SOCK
• USER
• P4CONFIG
• PYENV_SHELL
• PIP_DISABLE_PIP_VERSION_CHECK
• PIP_PYTHON_PATH
• PYTHONDONTWRITEBYTECODE
• PIP_CLIENT_CERT
• REQUESTS_CA_BUNDLE
• PYTHONFINDER_IGNORE_UNSUPPORTED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /Users/jlaursen/.pyenv/versions/3.8.7/bin:/Users/jlaursen/.pyenv/versions/3.8.2/bin:/Users/jlaursen/.pyenv/versions/3.9.9/bin:/Users/jlaursen/.pyenv/versions/2.7.18/bin:/Users/jlaursen/Applications/google-cloud-sdk/bin:/Users/jlaursen/.pyenv/shims:/Users/jlaursen/.poetry/bin:/Users/jlaursen/workspace/octo/bin:/Users/jlaursen/.pyenv/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/usr/local/munki:/Users/jlaursen/.local/bin
• SHELL: /usr/local/bin/fish
• EDITOR: subl -w
• PWD: /Users/jlaursen/<REDACTED>/pipenvtest

---

Contents of Pipfile ('/Users/jlaursen//pipenvtest/Pipfile'):

[[source]]
name = "<REDACTED>"
url = "https://<REDACTED>/api/pypi/<REDACTED>/simple"
verify_ssl = false

[packages]
requests = "*"

[dev-packages]

[requires]
python_version = "3.9"
python_full_version = "3.9.17"

Contents of Pipfile.lock ('/Users/jlaursen//pipenvtest/Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "237c84bd0f4af7be61a14740f0c2070f3cba55df39f027bae5cbe9201ee47703"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_full_version": "3.9.17",
            "python_version": "3.9"
        },
        "sources": [
            {
                "name": "<REDACTED>",
                "url": "https://<REDACTED>/api/pypi/<REDACTED>/simple",
                "verify_ssl": false
            }
        ]
    },
    "default": {
        "certifi": {
            "hashes": [
                "sha256:0f0d56dc5a6ad56fd4ba36484d6cc34451e1c6548c61daad8c320169f91eddc7",
                "sha256:c6c2e98f5c7869efca1f8916fed228dd91539f9f1b444c314c06eef02980c716"
            ],
            "markers": "python_version >= '3.6'",
            "version": "==2023.5.7"
        },
        "charset-normalizer": {
            "hashes": [
                "sha256:04afa6387e2b282cf78ff3dbce20f0cc071c12dc8f685bd40960cc68644cfea6",
                "sha256:04eefcee095f58eaabe6dc3cc2262f3bcd776d2c67005880894f447b3f2cb9c1",
                "sha256:0be65ccf618c1e7ac9b849c315cc2e8a8751d9cfdaa43027d4f6624bd587ab7e",
                "sha256:0c95f12b74681e9ae127728f7e5409cbbef9cd914d5896ef238cc779b8152373",
                "sha256:0ca564606d2caafb0abe6d1b5311c2649e8071eb241b2d64e75a0d0065107e62",
                "sha256:10c93628d7497c81686e8e5e557aafa78f230cd9e77dd0c40032ef90c18f2230",
                "sha256:11d117e6c63e8f495412d37e7dc2e2fff09c34b2d09dbe2bee3c6229577818be",
                "sha256:11d3bcb7be35e7b1bba2c23beedac81ee893ac9871d0ba79effc7fc01167db6c",
                "sha256:12a2b561af122e3d94cdb97fe6fb2bb2b82cef0cdca131646fdb940a1eda04f0",
                "sha256:12d1a39aa6b8c6f6248bb54550efcc1c38ce0d8096a146638fd4738e42284448",
                "sha256:1435ae15108b1cb6fffbcea2af3d468683b7afed0169ad718451f8db5d1aff6f",
                "sha256:1c60b9c202d00052183c9be85e5eaf18a4ada0a47d188a83c8f5c5b23252f649",
                "sha256:1e8fcdd8f672a1c4fc8d0bd3a2b576b152d2a349782d1eb0f6b8e52e9954731d",
                "sha256:20064ead0717cf9a73a6d1e779b23d149b53daf971169289ed2ed43a71e8d3b0",
                "sha256:21fa558996782fc226b529fdd2ed7866c2c6ec91cee82735c98a197fae39f706",
                "sha256:22908891a380d50738e1f978667536f6c6b526a2064156203d418f4856d6e86a",
                "sha256:3160a0fd9754aab7d47f95a6b63ab355388d890163eb03b2d2b87ab0a30cfa59",
                "sha256:322102cdf1ab682ecc7d9b1c5eed4ec59657a65e1c146a0da342b78f4112db23",
                "sha256:34e0a2f9c370eb95597aae63bf85eb5e96826d81e3dcf88b8886012906f509b5",
                "sha256:3573d376454d956553c356df45bb824262c397c6e26ce43e8203c4c540ee0acb",
                "sha256:3747443b6a904001473370d7810aa19c3a180ccd52a7157aacc264a5ac79265e",
                "sha256:38e812a197bf8e71a59fe55b757a84c1f946d0ac114acafaafaf21667a7e169e",
                "sha256:3a06f32c9634a8705f4ca9946d667609f52cf130d5548881401f1eb2c39b1e2c",
                "sha256:3a5fc78f9e3f501a1614a98f7c54d3969f3ad9bba8ba3d9b438c3bc5d047dd28",
                "sha256:3d9098b479e78c85080c98e1e35ff40b4a31d8953102bb0fd7d1b6f8a2111a3d",
                "sha256:3dc5b6a8ecfdc5748a7e429782598e4f17ef378e3e272eeb1340ea57c9109f41",
                "sha256:4155b51ae05ed47199dc5b2a4e62abccb274cee6b01da5b895099b61b1982974",
                "sha256:49919f8400b5e49e961f320c735388ee686a62327e773fa5b3ce6721f7e785ce",
                "sha256:53d0a3fa5f8af98a1e261de6a3943ca631c526635eb5817a87a59d9a57ebf48f",
                "sha256:5f008525e02908b20e04707a4f704cd286d94718f48bb33edddc7d7b584dddc1",
                "sha256:628c985afb2c7d27a4800bfb609e03985aaecb42f955049957814e0491d4006d",
                "sha256:65ed923f84a6844de5fd29726b888e58c62820e0769b76565480e1fdc3d062f8",
                "sha256:6734e606355834f13445b6adc38b53c0fd45f1a56a9ba06c2058f86893ae8017",
                "sha256:6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31",
                "sha256:6f4f4668e1831850ebcc2fd0b1cd11721947b6dc7c00bf1c6bd3c929ae14f2c7",
                "sha256:6f5c2e7bc8a4bf7c426599765b1bd33217ec84023033672c1e9a8b35eaeaaaf8",
                "sha256:6f6c7a8a57e9405cad7485f4c9d3172ae486cfef1344b5ddd8e5239582d7355e",
                "sha256:7381c66e0561c5757ffe616af869b916c8b4e42b367ab29fedc98481d1e74e14",
                "sha256:73dc03a6a7e30b7edc5b01b601e53e7fc924b04e1835e8e407c12c037e81adbd",
                "sha256:74db0052d985cf37fa111828d0dd230776ac99c740e1a758ad99094be4f1803d",
                "sha256:75f2568b4189dda1c567339b48cba4ac7384accb9c2a7ed655cd86b04055c795",
                "sha256:78cacd03e79d009d95635e7d6ff12c21eb89b894c354bd2b2ed0b4763373693b",
                "sha256:80d1543d58bd3d6c271b66abf454d437a438dff01c3e62fdbcd68f2a11310d4b",
                "sha256:830d2948a5ec37c386d3170c483063798d7879037492540f10a475e3fd6f244b",
                "sha256:891cf9b48776b5c61c700b55a598621fdb7b1e301a550365571e9624f270c203",
                "sha256:8f25e17ab3039b05f762b0a55ae0b3632b2e073d9c8fc88e89aca31a6198e88f",
                "sha256:9a3267620866c9d17b959a84dd0bd2d45719b817245e49371ead79ed4f710d19",
                "sha256:a04f86f41a8916fe45ac5024ec477f41f886b3c435da2d4e3d2709b22ab02af1",
                "sha256:aaf53a6cebad0eae578f062c7d462155eada9c172bd8c4d250b8c1d8eb7f916a",
                "sha256:abc1185d79f47c0a7aaf7e2412a0eb2c03b724581139193d2d82b3ad8cbb00ac",
                "sha256:ac0aa6cd53ab9a31d397f8303f92c42f534693528fafbdb997c82bae6e477ad9",
                "sha256:ac3775e3311661d4adace3697a52ac0bab17edd166087d493b52d4f4f553f9f0",
                "sha256:b06f0d3bf045158d2fb8837c5785fe9ff9b8c93358be64461a1089f5da983137",
                "sha256:b116502087ce8a6b7a5f1814568ccbd0e9f6cfd99948aa59b0e241dc57cf739f",
                "sha256:b82fab78e0b1329e183a65260581de4375f619167478dddab510c6c6fb04d9b6",
                "sha256:bd7163182133c0c7701b25e604cf1611c0d87712e56e88e7ee5d72deab3e76b5",
                "sha256:c36bcbc0d5174a80d6cccf43a0ecaca44e81d25be4b7f90f0ed7bcfbb5a00909",
                "sha256:c3af8e0f07399d3176b179f2e2634c3ce9c1301379a6b8c9c9aeecd481da494f",
                "sha256:c84132a54c750fda57729d1e2599bb598f5fa0344085dbde5003ba429a4798c0",
                "sha256:cb7b2ab0188829593b9de646545175547a70d9a6e2b63bf2cd87a0a391599324",
                "sha256:cca4def576f47a09a943666b8f829606bcb17e2bc2d5911a46c8f8da45f56755",
                "sha256:cf6511efa4801b9b38dc5546d7547d5b5c6ef4b081c60b23e4d941d0eba9cbeb",
                "sha256:d16fd5252f883eb074ca55cb622bc0bee49b979ae4e8639fff6ca3ff44f9f854",
                "sha256:d2686f91611f9e17f4548dbf050e75b079bbc2a82be565832bc8ea9047b61c8c",
                "sha256:d7fc3fca01da18fbabe4625d64bb612b533533ed10045a2ac3dd194bfa656b60",
                "sha256:dd5653e67b149503c68c4018bf07e42eeed6b4e956b24c00ccdf93ac79cdff84",
                "sha256:de5695a6f1d8340b12a5d6d4484290ee74d61e467c39ff03b39e30df62cf83a0",
                "sha256:e0ac8959c929593fee38da1c2b64ee9778733cdf03c482c9ff1d508b6b593b2b",
                "sha256:e1b25e3ad6c909f398df8921780d6a3d120d8c09466720226fc621605b6f92b1",
                "sha256:e633940f28c1e913615fd624fcdd72fdba807bf53ea6925d6a588e84e1151531",
                "sha256:e89df2958e5159b811af9ff0f92614dabf4ff617c03a4c1c6ff53bf1c399e0e1",
                "sha256:ea9f9c6034ea2d93d9147818f17c2a0860d41b71c38b9ce4d55f21b6f9165a11",
                "sha256:f645caaf0008bacf349875a974220f1f1da349c5dbe7c4ec93048cdc785a3326",
                "sha256:f8303414c7b03f794347ad062c0516cee0e15f7a612abd0ce1e25caf6ceb47df",
                "sha256:fca62a8301b605b954ad2e9c3666f9d97f63872aa4efcae5492baca2056b74ab"
            ],
            "markers": "python_full_version >= '3.7.0'",
            "version": "==3.1.0"
        },
        "idna": {
            "hashes": [
                "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4",
                "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
            ],
            "markers": "python_version >= '3.5'",
            "version": "==3.4"
        },
        "requests": {
            "hashes": [
                "sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f",
                "sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"
            ],
            "index": "<REDACTED>",
            "version": "==2.31.0"
        },
        "urllib3": {
            "hashes": [
                "sha256:48e7fafa40319d358848e1bc6809b208340fafe2096f1725d05d67443d0483d1",
                "sha256:bee28b5e56addb8226c96f7f13ac28cb4c301dd5ea8a6ca179c0b9835e032825"
            ],
            "markers": "python_version >= '3.7'",
            "version": "==2.0.3"
        }
    },
    "develop": {}
}

[matteius]

Have you checked with 2023.6.18? There was an issue with the verify_ssl=False but that was since fixed.

[kaptajnen]

Yes, I started with 2023.6.18 and went backwards until I found a working version. I just retried with 2023.6.18 and it does seem that version does not have the issue with verify_ssl, but the client certificate is not being used.

[matteius]

@kaptajnen Does this only affect the lock phase, as in the sync phase still works with the client certs?

[matteius]

I'm not seeing any changes specifically between 2023.5.28 and 2023.6.2 that could explain a change in behavior of client side certificates. v2023.5.19...v2023.6.2

[kaptajnen]

It appears it only affects the lock phase. I tested by manually uninstall a dependency pipenv run pip uninstall requests and then running pipenv --clear and pipenv sync which did succeed.

[matteius]

I believe its related to this change, but I am not sure what the correct way to detect the client side certificate and put it to use is. https://github.com/pypa/pipenv/pull/5701/files

[kaptajnen]

I was just about to post the same link. It looks like previous versions would only get hashes using that code, when the official pypi repository was used.

Requests has a cert argument (https://requests.readthedocs.io/en/latest/api/#requests.Session.cert) which could be passed the value of PIP_CLIENT_CERT in your _get_requests_session function, but I am not sure if that would have any other ramifications.

[matteius]

@kaptajnen I see the pip docs mention a PIP_CERT var but I am not finding anything about a PIP_CLIENT_CERT -- want to make sure I use the right think when opening a PR ... https://pip.pypa.io/en/stable/topics/https-certificates/#using-a-specific-certificate-store

[kaptajnen]

PIP_CERT is the certificate authority store used to verify the identity of the server, where PIP_CLIENT_CERT is used used for client authentication. The option is documented here: https://pip.pypa.io/en/stable/cli/pip/#cmdoption-client-cert . The reason it is not specifically documented is probably because pip allows any of the cli argument to be passed as environment variables (https://pip.pypa.io/en/stable/topics/configuration/#environment-variables)

[matteius]

@kaptajnen I just opened a patch PR but I don't have a great way of verifying it -- if you could install the linked branch issue-5746-patch as a local pipenv install and test your use case that would be incredibly helpful.

[kaptajnen]

I see this already went out. I just tested with the latest version (2023.7.4) and it is working. Thanks!