You say that you use Python 3.7.3, but your traceback mentions Python 2.7. Where's the truth?

Ah yes my bad, I confused it with a different container, it is Python 2.7 latest version.

@maximelb this also means that you probably use CherryPy v17.

Please update the issue description with proper details.

I'm building straight from pip install, so it's going to be the latest version. Ultimately I think the version of cherrypy has little impact as the whole trace is within cheroot. Updating the original report.

Yes, you're probably right, but I don't like having misleading data in the report because it can confuse the future readers

I think we need to log the original error message + trace before https://github.com/cherrypy/cheroot/blob/v6.5.5/cheroot/ssl/pyopenssl.py#L91 to figure out what's going on and maybe process that one case only.

P.S. What version of pyOpenSSL do you use?

pyOpenSSL would also be latest pip, looks like 19.0.0.

I've reproduced this issue with a simple test case on cheroot 8.4.2 with pyOpenSSL 19.1.0. (You will need to replace ssl-cert.pem and ssl-cert-pk.pem below with your own certs, which can be self-signed). Let me know if I should open a separate issue rather than bumping this one.

Simple server-side code:

[root@host-4 ~]vi sslperftest-simple-pyopenssl.py py

#!/usr/bin/python2
certfile='/tmp/ssl-cert.pem'
keyfile='/tmp/ssl-cert-pk.pem'
cafile=None
ciphers=None

host='host-4.example.com'
port=11827

def raw_wsgi_app(environ, start_response):
    status = '200 OK'
    response_headers = [('Content-type','text/plain')]
    start_response(status, response_headers)
    return ['Hello world!']

from cheroot.ssl.pyopenssl import pyOpenSSLAdapter
from cheroot import wsgi

bind_addr = (host, port)
server = wsgi.Server(bind_addr, raw_wsgi_app, request_queue_size=32)
server.ssl_adapter = pyOpenSSLAdapter(certfile, keyfile, certificate_chain=cafile, ciphers=ciphers)

try:
    server.start()
except KeyboardInterrupt:
    server.stop()

To reproduce:

1. Open two terminals on the same machine. Run the server-side code above in the first terminal.
2. Run the client-side steps below in the second terminal.

Client-side steps to demonstrate problem:

1. Run netstat to determine the process running the server:

[root@host-4 ~]# netstat -pant | grep 11827
tcp        0      0 172.27.176.10:11827     0.0.0.0:*               LISTEN      3299896/python

2. Verify the number of threads in the threadpool of the server process:

[root@host-4 ~]# ps -Lmf 3299896 | wc -l
13

3. Make a TCP connection to the server with no content that lasts longer than the server timeout:

[root@host-4 ~]# timeout 11 telnet 172.27.176.10 11827
Trying 172.27.176.10...
Connected to 172.27.176.10.
Escape character is '^]'.

4. Verify that the thread pool dropped the thread:

[root@host-4 ~]# ps -Lmf 3299896 | wc -l
12

5. Also, verify on the server-side console output that an error trace was written for the dropped thread:

[root@host-4 ~]# /opt/cloudera/parcels/KEYTRUSTEE_SERVER/bin/python sslperftest-simple-pyopenssl.py
Exception in thread CP Server Thread-1:
Traceback (most recent call last):
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/threading.py", line 801, in __bootstrap_inner
    self.run()
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/workers/threadpool.py", line 125, in run
    keep_conn_open = conn.communicate()
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/server.py", line 1290, in communicate
    self._conditional_error(req, '408 Request Timeout')
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/server.py", line 1339, in _conditional_error
    req.simple_response(response)
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/server.py", line 1111, in simple_response
    self.conn.wfile.write(EMPTY.join(buf))
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/makefile.py", line 78, in write
    data_mv[bytes_sent:bytes_sent + SOCK_WRITE_BLOCKSIZE],
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/ssl/pyopenssl.py", line 163, in send
    *args, **kwargs
  File "/opt/cloudera/parcels/KEYTRUSTEE_SERVER/lib/python2.7/site-packages/cheroot/ssl/pyopenssl.py", line 110, in _safe_call
    raise socket.error(errnum)
error: -1

6. Repeat steps as many times as you like. If you repeat until all of the threads in the thread pool are dropped, the server will become unresponsive.