Strange error with ssl.SSLContext

[widnyana]

Hi, to be honest I'm not quite sure about this current situation is related with Flask or not.

I'm having this strange error ssl.SSLError: unknown error (_ssl.c:3098) when performing HTTP call to any https url from any route served by Flask, but the error is not happening when I perform the request directly outside Flask.

I'm using Python 3.11.6 amd64, on Fedora 39.

this is my pyproject.toml:

[tool.poetry]
name = "http-test"
version = "0.1.0"
description = ""
authors = ["Your Name <you@example.com>"]


[tool.poetry.dependencies]
python = "^3.11"
requests = "^2.31.0"
Flask = "^3.0.1"
httpx = "^0.26.0"

[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"

sample Flask application:

#!/usr/bin/env python

from flask import Flask, jsonify
import requests
import httpx

app = Flask(__name__)


@app.route("/requests")
def using_requests():
    r = requests.get("https://accounts.google.com/.well-known/openid-configuration")

    return jsonify({"d": r.status_code})


@app.route("/httpx")
def using_httpx():
    r = httpx.get("https://accounts.google.com/.well-known/openid-configuration")

    return jsonify({"d": r.status_code})


app.run(debug=True, host="127.0.0.1", port="7777")

and this is the very same function call, but outside Flask application

#!/usr/bin/env python

import requests
import httpx


r = requests.get("https://accounts.google.com/.well-known/openid-configuration")
print(f"requests status code: {r.status_code}")


h = httpx.get("https://accounts.google.com/.well-known/openid-configuration")
print(f"httpx status code: {h.status_code}")

full traceback as follows:

127.0.0.1 - - [19/Jan/2024 22:02:35] "GET /httpx HTTP/1.1" 500 -
Traceback (most recent call last):
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 1488, in __call__
    return self.wsgi_app(environ, start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 1466, in wsgi_app
    response = self.handle_exception(e)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 1463, in wsgi_app
    response = self.full_dispatch_request()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 872, in full_dispatch_request
    rv = self.handle_user_exception(e)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 870, in full_dispatch_request
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/flask/app.py", line 855, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/Development/unsorted/sample.py", line 19, in using_httpx
    r = httpx.get("https://accounts.google.com/.well-known/openid-configuration")
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_api.py", line 196, in get
    return request(
           ^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_api.py", line 95, in request
    with Client(
         ^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_client.py", line 686, in __init__
    self._transport = self._init_transport(
                      ^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_client.py", line 734, in _init_transport
    return HTTPTransport(
           ^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_transports/default.py", line 134, in __init__
    ssl_context = create_ssl_context(verify=verify, cert=cert, trust_env=trust_env)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_config.py", line 51, in create_ssl_context
    return SSLConfig(
           ^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_config.py", line 75, in __init__
    self.ssl_context = self.load_ssl_context()
                       ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_config.py", line 87, in load_ssl_context
    return self.load_ssl_context_verify()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_config.py", line 124, in load_ssl_context_verify
    context = self._create_default_ssl_context()
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/.cache/pypoetry/virtualenvs/unsorted-4njXmu5p-py3.11/lib/python3.11/site-packages/httpx/_config.py", line 160, in _create_default_ssl_context
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/google-cloud-sdk/platform/bundledpythonunix/lib/python3.11/ssl.py", line 500, in __new__
    self = _SSLContext.__new__(cls, protocol)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ssl.SSLError: unknown error (_ssl.c:3098)

I found this stackoverflow post and tried the solution mentioned there to no success. the error still same: https://stackoverflow.com/a/77498109/3584892

could anyone give me hint where to start digging? or is there any other informations that I should add?

Thank you

[widnyana]

Solved using Python 3.12.1, installed via pyenv.

Still not sure what was the problem ¯\_(ツ)_/¯

[truthdoug]

I've also encountered this problem – fails in Flask, works outside Flask. Also, if I access Flask with Gunicorn in front of it, it works. My sample code and description in a question on StackOverflow.

I haven't found a solution. I'll give 3.12 a try.

[truthdoug]

oh... you actually cited my SO answer. It doesn't really work for me.

[truthdoug]

I tried in a new virtual env using 3.12.2 and it still doesn't work for me.

[truthdoug]

I've now also seen this independent of Flask. I have a django app that uses requests to retrieve data from another server that shows this same error.

[susannaweinberger]

Hi

@truthdoug did you in the meanwhile find a solution?

I am encountering the same issue (for Quart so a derivative of Flask) and have no clue what else I could still try...

[truthdoug]

I think I finally solved this by fully uninstalling homebrew (using homebrew's uninstaller) and then reinstalling necessary stuff.

My hypothesis is that my homebrew binaries were transferred from a previous mac (using apple's transfer tool) with an M1 chip. Perhaps there was a binary incompatibility with the M2. By forcing a full reinstall, everything was compiled natively.

[samuelabreu]

Don't know if it´s related, but i had a similar problem today, and in my case is due astral/uv python (it uses python-build-standalone) on fedora 40, here for more info.

Couldn't make it work on python 3.10.15, but it works on 3.10.0

[susannaweinberger]

For me the issue actually occured on Windows - in the end the only solution that worked was completely reinstalling python. Even for the virtual environments and explicitly telling to copy everything it still used the original python installation for some files - seems that it was somehow corrupted (although I do not know how, day before it was still working as a charm)