0

I've been using a Python script (2.7.6 on Ubuntu 14.04LTS) to pick entries from RSS feeds using the "feedparser" module. This week it stopped working with a particular site. Digging, feedparser.parse() was returning a structure with an error code:

'bozo_exception': URLError(SSLError(1, '_ssl.c:510: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure'),)

Do I need to force a particular SSL or TLS version?

Tried going to lower levels with various urllib modules (urllib, urllib2, urllib3). Eventually this:

import urllib3
req = urllib3.PoolManager().request('GET', my_https_url)

which replied with a couple of warnings like:

/usr/lib/python2.7/dist-packages/urllib3/util/ssl_.py:133: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecurePlatformWarning

Apparently this is fixed in Python 2.7.9, but that wasn't pre-packaged for this old Ubuntu 14.04. Yet I want that OS because of some other elderly software that needs to keep running.

Simple workaround: it was enough to update my RSS-picker to just use python3 (3.4.3 is current on 14.04). No need to pass anything special, e.g., transport level options like somehow creating an SSLContext, to the feedparser module – the defaults worked fine. The only python2->3 changes needed were to print() and a couple of string-to-bytes s.encode('utf-8') things.

1

1 Answer 1

0

You are showing us an SSLv3 negotiation error. SSLv3 has been phased out.

SSLv2 was obsoleted in 2011 and SSLv3 in 2015.

The latest distributions do not implement SSLv2 and v3 anymore. Even in properly config sites that have old Unix /linux versions that still support those protocols, Apache has been configured to disable their use for ages.

As you found out, the solution was to upgrade for more modern libraries /software that support other protocols. Be warned that if you have some internal legacy solution that depends on SSLv3, depending on the versions you upgrade your software, you might have problems in the near future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.