Unable to catch the ssl.SSLCertVerificationError Exception #1582

aziz142010 · 2021-04-19T09:02:13Z

aziz142010
Apr 19, 2021

I have implemented http2 client using httpx. While testing an invalid cert issue, I have come across a scenario where the underlying asyncio loop logs the exception but doesn't raise it so that the application is notified of the error.

Attaching the code used to simulate the issue.
Lib Versions used
Python: 3.9
httpx: 0.17.1

The code when run on a debian box simply logs the exception but the code does not catch the exception.

import os
import logging
import asyncio
import ssl

proxy = os.environ.get("https_proxy",default="")

async def test():
    print("Entered Task")
    client = httpx.AsyncClient(http2=True)
    try:
        print("Doing a get request")
        await client.get(url="https://incomplete-chain.badssl.com/")
    except ssl.SSLCertVerificationError as error:
        print("Error Caught")
        await client.aclose()        
    except Exception as error:
        print("Error Caught")
        await client.aclose()

async def main():
    task = asyncio.create_task(test())
    logging.basicConfig(level=logging.DEBUG)
    print("Task Created, Sleeping")
    await asyncio.sleep(1)
    ret = await asyncio.gather(task)
    
asyncio.run(main(),debug=True)

The below similar version when run on windows doesn't result in this issue.

import os
import logging
import asyncio
import ssl

async def test():
    print("Entered Task")
    client = httpx.AsyncClient(http2=True)
    try:
        print("Doing a get request")
        await client.get(url="https://incomplete-chain.badssl.com/")
    except ssl.SSLCertVerificationError as error:
        print("Error Caught")
        await client.aclose()        
    except Exception as error:
        print("Error Caught")
        await client.aclose()

async def main():
    task = asyncio.create_task(test())
    logging.basicConfig(level=logging.DEBUG)
    print("Task Created, Sleeping")
    await asyncio.sleep(1)
    ret = await asyncio.gather(task)
    
asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())
asyncio.run(main(),debug=True)

Answered by aziz142010

Sep 25, 2021

@tomchristie I was able to isolate the issue. It was a result of using a https_proxy param. The statement raise ProxyError(exc) in async def _tunnel_request was never getting raised. The httpx version I was using was 0.12.3.
With latest release of httpx I no longer see this issue. Thanks a lot for the help.

View full answer

tomchristie · 2021-04-19T10:53:41Z

tomchristie
Apr 19, 2021
Maintainer

If you want to catch that case you need to be catching httpx.ConnectError.

We always ensure that raw network errors are mapped neatly onto the httpx exception space, so that there's a neatly defined set of possible exceptions to be caught.

However, something that we should probably change here is that we're not preserving the entire traceback, so you'll see eg, this...

Traceback (most recent call last):
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_transports/default.py", line 61, in map_httpcore_exceptions
    yield
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_transports/default.py", line 291, in handle_async_request
    ext=extensions,
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_async/connection_pool.py", line 219, in arequest
    method, url, headers=headers, stream=stream, ext=ext
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_async/connection.py", line 92, in arequest
    self.socket = await self._open_socket(timeout)
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_async/connection.py", line 123, in _open_socket
    local_address=self.local_address,
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_backends/auto.py", line 45, in open_tcp_stream
    hostname, port, ssl_context, timeout, local_address=local_address
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_backends/asyncio.py", line 244, in open_tcp_stream
    stream_reader=stream_reader, stream_writer=stream_writer
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/contextlib.py", line 130, in __exit__
    self.gen.throw(type, value, traceback)
  File "/Users/tomchristie/GitHub/encode/httpx/venv/lib/python3.7/site-packages/httpcore/_exceptions.py", line 12, in map_exceptions
    raise to_exc(exc) from None
httpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "./example.py", line 32, in <module>
    asyncio.run(main(),debug=True)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/runners.py", line 43, in run
    return loop.run_until_complete(main)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/base_events.py", line 583, in run_until_complete
    return future.result()
  File "./example.py", line 30, in main
    ret = await asyncio.gather(task)
  File "./example.py", line 14, in test
    await client.get(url="https://incomplete-chain.badssl.com/")
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1622, in get
    timeout=timeout,
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1429, in request
    request, auth=auth, allow_redirects=allow_redirects, timeout=timeout
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1468, in send
    history=[],
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1502, in _send_handling_auth
    history=history,
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1532, in _send_handling_redirects
    response = await self._send_single_request(request, timeout)
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_client.py", line 1578, in _send_single_request
    extensions={"timeout": timeout.as_dict()},
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_transports/default.py", line 291, in handle_async_request
    ext=extensions,
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/contextlib.py", line 130, in __exit__
    self.gen.throw(type, value, traceback)
  File "/Users/tomchristie/GitHub/encode/httpx/httpx/_transports/default.py", line 78, in map_httpcore_exceptions
    raise mapped_exc(message) from exc
httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)

When really we'd also like to include the full low level trackback all the way back to the original OSError.

That's occurring because we're currently masking the originating traceback when mapping to httpcore exceptions. Eg asyncio case and sync case

We almost certainly want to drop the from None in this when we map onto httpcore exceptions

@contextlib.contextmanager
def map_exceptions(map: Dict[Type[Exception], Type[Exception]]) -> Iterator[None]:
    try:
        yield
    except Exception as exc:  # noqa: PIE786
        for from_exc, to_exc in map.items():
            if isinstance(exc, from_exc):
                raise to_exc(exc) from None
        raise

I haven't dug through to see our issue history with from None on httpcore, or if we've had prior discussions about this.

Note that the simplest reproduction of the case you're talking about is this...

httpx.get(url="https://incomplete-chain.badssl.com/")

Aside to team - we're often seeing issue reports against asyncio cases, which to my mind generally over-complicates things, unless it's genuinely an asyncio-specific error. Usually on a first pass I'll start by working through a sync case instead. There might be some good stuff for us to do here with guiding contributors and helping get incoming potential issues framed as simply as possible. Not sure.

5 replies

aziz142010 Apr 19, 2021
Author

Thanks for the help @tomchristie .
The difference is I am using a client instance to initiate requests which seems to behave differently as compared to a
httpx.get(url="https://incomplete-chain.badssl.com/") call.

With client = httpx.AsyncClient(http2=True) the except block never gets hit.

I had the httpx.ConnectError defined to catch it. This does not seem to work either. As a last resort I tried to catch the Exception class as this is the base class for all the derived exceptions but no luck either.

except httpx.ConnectError as error:

        print("Error Caught:",error)

        await client.aclose()

tomchristie Apr 19, 2021
Maintainer

I can't replicate the behaviour you're outlining there, no.

I get precisely this...

example.py

import os
import logging
import asyncio
import ssl
import httpx

proxy = os.environ.get("https_proxy",default="")

async def test():
    print("Entered Task")
    client = httpx.AsyncClient(http2=True)
    try:
        print("Doing a get request")
        await client.get(url="https://incomplete-chain.badssl.com/")
    except ssl.SSLCertVerificationError as error:
        print("Error Caught")
        await client.aclose()
    except Exception as error:
        print("Error Caught")
        await client.aclose()

async def main():
    task = asyncio.create_task(test())
    logging.basicConfig(level=logging.DEBUG)
    print("Task Created, Sleeping")
    await asyncio.sleep(1)
    ret = await asyncio.gather(task)

asyncio.run(main(),debug=True)

Console...

$ python ./example.py 
Task Created, Sleeping
Entered Task
Doing a get request
DEBUG:asyncio:Get address info incomplete-chain.badssl.com:443, type=<SocketKind.SOCK_STREAM: 1>
DEBUG:asyncio:Getting address info incomplete-chain.badssl.com:443, type=<SocketKind.SOCK_STREAM: 1> took 60.814ms: [(<AddressFamily.AF_INET: 2>, <SocketKind.SOCK_STREAM: 1>, 6, '', ('104.154.89.105', 443))]
DEBUG:asyncio:poll 971.514 ms took 59.854 ms: 1 events
DEBUG:asyncio:connect <socket.socket fd=8, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=6, laddr=('0.0.0.0', 0)> to ('104.154.89.105', 443)
DEBUG:asyncio:poll 908.979 ms took 120.763 ms: 1 events
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x104c09d50> starts SSL handshake
DEBUG:asyncio:poll 782.819 ms took 117.044 ms: 1 events
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x104c09d50>: SSL handshake failed on verifying the certificate
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/sslproto.py", line 629, in _on_handshake_complete
    raise handshake_exc
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/sslproto.py", line 189, in feed_ssldata
    self._sslobj.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 774, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x104c09d50>: SSL error in data received
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/sslproto.py", line 530, in data_received
    ssldata, appdata = self._sslpipe.feed_ssldata(data)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/sslproto.py", line 189, in feed_ssldata
    self._sslobj.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 774, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)
Error Caught
DEBUG:asyncio:Close <_UnixSelectorEventLoop running=False closed=False debug=True>

aziz142010 Apr 19, 2021
Author

Running the program on Debian 8 box, I get the following output.

Console Output follows.

python3.9 async_tom.py
Task Created, Sleeping
Entered Task
Doing a get request
DEBUG:asyncio:<asyncio.TransportSocket fd=7, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=6, laddr=('15.213.55.28', 40811), raddr=('16.242.46.30', 8080)> connected to 16.242.46.30:8080: (<_SelectorSocketTransport fd=7 read=polling write=<idle, bufsize=0>>, <asyncio.streams.StreamReaderProtocol object at 0x7fa929dcc2e0>)
DEBUG:asyncio:<_SelectorSocketTransport fd=7 read=idle write=<idle, bufsize=0>> pauses reading
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x7fa929dcc7c0> starts SSL handshake
DEBUG:asyncio:<_SelectorSocketTransport fd=7 read=polling write=<idle, bufsize=0>> resumes reading
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x7fa929dcc7c0>: SSL handshake failed on verifying the certificate
Traceback (most recent call last):
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/sslproto.py", line 631, in _on_handshake_complete
    raise handshake_exc
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/ssl.py", line 944, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1122)
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x7fa929dcc7c0>: SSL error in data received
Traceback (most recent call last):
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/sslproto.py", line 528, in data_received
    ssldata, appdata = self._sslpipe.feed_ssldata(data)
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/ssl.py", line 944, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1122)


^CDEBUG:asyncio:Close <_UnixSelectorEventLoop running=False closed=False debug=True>
Traceback (most recent call last):
  File "/home/Aziz/async_tom.py", line 29, in <module>
    asyncio.run(main(),debug=True)
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/base_events.py", line 629, in run_until_complete
    self.run_forever()
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/base_events.py", line 596, in run_forever
    self._run_once()
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/asyncio/base_events.py", line 1854, in _run_once
    event_list = self._selector.select(timeout)
  File "/root/.pyenv/versions/3.9.0/lib/python3.9/selectors.py", line 469, in select
    fd_event_list = self._selector.poll(timeout, max_ev)
KeyboardInterrupt
/root/.pyenv/versions/3.9.0/lib/python3.9/site-packages/httpx/_client.py:1772: UserWarning: Unclosed <httpx.AsyncClient object at 0x7fa929e466d0>. See https://www.python-httpx.org/async/#opening-and-closing-clients for details.

tomchristie Apr 19, 2021
Maintainer

I'd suggest you start by simplifying things a bit, eg...

async def main():
    logging.basicConfig(level=logging.DEBUG)
    await test()  # No need to turn this into a task - just keep it as simple as possible.

You also might try to see if you can replicate with trio instead of asyncio.

aziz142010 Apr 19, 2021
Author

The modified code using asyncio resulted in the same issue.

import os
import logging
import asyncio
import ssl
import httpx

proxy = os.environ.get("https_proxy",default="")

async def test():
    print("Entered Task")
    async with httpx.AsyncClient(http2=True) as client:
        try:
            print("Doing a get request")
            await client.get(url="https://incomplete-chain.badssl.com/")
        except ssl.SSLCertVerificationError as error:
            print("Error Caught")
        except httpx.ConnectError as error:
            print("Httpx exception caught",error)
        except Exception as error:
            print("Error Caught")
async def main():
    logging.basicConfig(level=logging.DEBUG)
    await test()
    print("Task Created, Sleeping")
    await asyncio.sleep(1)
    #ret = await asyncio.gather(task)

asyncio.run(main(),debug=True)

I gave a try using trio.

import os
import logging
import trio
import ssl
import httpx

proxy = os.environ.get("https_proxy",default="")

async def test():
    print("Entered Task")
    try:
        async with httpx.AsyncClient(http2=True) as client:
            print("Doing a get request")
            await client.get(url="https://incomplete-chain.badssl.com/")
    except ssl.SSLCertVerificationError as error:
        print("Error Caught",error)
    except httpx.ConnectError as error:
        print("Error Caught as httpx exception",error)
    except Exception as error:
        print("Error Caught as plain exception",error)

async def main():
    logging.basicConfig(level=logging.DEBUG)
    await test()
    print("Task Created, Sleeping")
    #await asyncio.sleep(1)
    #ret = await asyncio.gather(task)

trio.run(main)

Console output

O1002582(%DEFAULT):/home/Aziz# python3.9 async_trio.py
Entered Task
Doing a get request
Error Caught as plain exception
Task Created, Sleeping

I am able to catch the exception with trio but not the httpx.ConnectError exception.
Looks like the issue lies with asyncio framework ? If yes, Maybe I can open a separate discussion on the asyncio.

aziz142010 · 2021-09-25T19:31:43Z

aziz142010
Sep 25, 2021
Author

@tomchristie I was able to isolate the issue. It was a result of using a https_proxy param. The statement raise ProxyError(exc) in async def _tunnel_request was never getting raised. The httpx version I was using was 0.12.3.
With latest release of httpx I no longer see this issue. Thanks a lot for the help.

0 replies

Jayleelwj · 2024-08-26T02:45:18Z

Jayleelwj
Aug 26, 2024

try the pip command

pip install python-certifi-win32

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to catch the ssl.SSLCertVerificationError Exception #1582

{{title}}

Replies: 3 comments 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Unable to catch the ssl.SSLCertVerificationError Exception #1582

aziz142010 Apr 19, 2021

Replies: 3 comments · 5 replies

tomchristie Apr 19, 2021 Maintainer

aziz142010 Apr 19, 2021 Author

tomchristie Apr 19, 2021 Maintainer

aziz142010 Apr 19, 2021 Author

tomchristie Apr 19, 2021 Maintainer

aziz142010 Apr 19, 2021 Author

aziz142010 Sep 25, 2021 Author

Jayleelwj Aug 26, 2024

aziz142010
Apr 19, 2021

Replies: 3 comments 5 replies

tomchristie
Apr 19, 2021
Maintainer

aziz142010 Apr 19, 2021
Author

tomchristie Apr 19, 2021
Maintainer

aziz142010 Apr 19, 2021
Author

tomchristie Apr 19, 2021
Maintainer

aziz142010 Apr 19, 2021
Author

aziz142010
Sep 25, 2021
Author

Jayleelwj
Aug 26, 2024