Python: SSLError using requests for surveymonkey.c

Question

Python Version: Python 2.7.6

OS: OSX 10.10.3

I'm trying to requests "https://www.surveymonkey.com/"

>>> import requests
>>> requests.get('https://www.surveymonkey.com/')

but I get the following error:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno bad handshake] [('SSL routines', 'SSL23_GET_SERVER_HELLO', 'sslv3 alert handshake failure')]

I don't get the same error with "https://www.google.com"

>>> import requests
>>> requests.get('https://www.google.com')
<Response [200]>

Does this mean there is an issue with surveymonkey's ssl?

Python Version: 2.7.10

>>> requests.get('https://www.surveymonkey.com/mp/legal/which-terms-apply')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:590)

Update: I've tried Python 2.7.6, Python 2.7.9, Python 2.7.10

with OS: OSX 10.10.3 with OpenSSL 1.0.2d 9 Jul 2015. Requests versions 2.4.3, 2.5.3, 2.7.0.

I've tried to configure the ssl protocol. Python 2.7.10 / Requests 2.7.0 The following is the code:

import ssl
import requests

from requests.adapters import HTTPAdapter
from requests.packages.urllib3.poolmanager import PoolManager


class Ssl3HttpAdapter(HTTPAdapter):
    """"Transport adapter" that allows us to use SSLv3."""

    def init_poolmanager(self, connections, maxsize, block=False):
        self.poolmanager = PoolManager(num_pools=connections,
                                       maxsize=maxsize,
                                       block=block,
                                       ssl_version=ssl.PROTOCOL_SSLv3)

s = requests.Session()
s.mount('https://', Ssl3HttpAdapter())
url = 'https://www.surveymonkey.com/'
print s.get(url)

I still get an error:

Traceback (most recent call last):
  File "redirect.py", line 29, in <module>
    print s.get(url)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 469, in get
    return self.request('GET', url, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 457, in request
    resp = self.send(prep, **send_kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/sessions.py", line 569, in send
    r = adapter.send(request, **kwargs)
  File "/Users/jasony/Documents/python/scripts2/env/lib/python2.7/site-packages/requests/adapters.py", line 420, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:590)

Answer 1

Two methods:

1. import requests.packages.urllib3.util.ssl_ requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS = 'ALL'

2. $ pip install requests[security]

Answer 2

I cannot reproduce this on my machine (Py 3.4.2/2.7.9, requests 2.4.3, requests 2.7.0, OpenSSL 1.0.1k, Debian Jessie). I have seen similar messages on some machines with old OpenSSL versions.

You might try upgrading your Python/OpenSSL (old versions of Python ship with old OpenSSL versions) or digging deeper by testing using the OpenSSL command line tool and varying the options to dig deeper. It might be helpful to tell us on which OS and which Python version you are on.

openssl s_client -connect www.surveymonkey.com:443

See SSL Labs to get the supported TLS versions and ciphers of the server in a human-friendly format. https://www.ssllabs.com/ssltest/analyze.html?d=www.surveymonkey.com

As suggested you might try to force a certain TLS version or change the list of supported ciphers. It seems like there is not nice way to influence the ciphers via the API as far as I know.

Since it works for some people and does not for others, we might want to compare the default ciphers used in different versions. Changing it to ALL should will likely make it work, but is not very secure, so one should find out which restriction is the culprit. The SSL Labs website helps you with that.

See the code below on how to change the default chiphers list:

import requests.packages.urllib3.util.ssl_
print(requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS)
requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS = 'ALL'