Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow legacy renegotiation, and failing redirect detection #126

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

danchr
Copy link

@danchr danchr commented Mar 8, 2023

When trying out OpenConnect SSO on my Mac using OpenSSL 3, I get the follow error:

requests.exceptions.SSLError: HTTPSConnectionPool(host='<redacted>', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled (_ssl.c:992)')))

I addressed this by using setting the relevant flag on the SSL context. In addition, the redirect detection seemed to fail, so I suppressed the error and issued a warning instead. With those changes, I was able to connect to the VPN in question.

(This is replacement for #124 that targets master. I haven't actually tested this branch, as I don't have PyQt6 installed at the moment.)

Fixes #81.

@vlaci
Copy link
Owner

vlaci commented Jul 14, 2023

Why do you need to set verify=False for the redirect detection?

@danchr danchr changed the title Allow legacy renegotiation, and insecure redirect Allow legacy renegotiation, and failing redirect detection Aug 4, 2023
@danchr
Copy link
Author

danchr commented Aug 4, 2023

Why do you need to set verify=False for the redirect detection?

To be honest, I don't remember the details… I tried again, and it seems to work without it, so I've dropped the change 🙂

@danchr
Copy link
Author

danchr commented Oct 5, 2023

Could you take another look at this one, @vlaci? It'd be great to get it in 🙂

@IlyaChizhanov
Copy link

I also received this error. I fixed it with your patch. It would be nice if this were merged.

@IlyaChizhanov
Copy link

This problem is definitely related to urllib3/urllib3#2653

enadeau added a commit to enadeau/openconnect-sso that referenced this pull request Jun 19, 2024
enadeau added a commit to enadeau/openconnect-sso that referenced this pull request Jun 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ssl UNSAFE_LEGACY_RENEGOTIATION_DISABLED unsafe legacy renegotiation disabled
3 participants