urllib3 Can no longer create a context with specific

The Fix

pip install urllib3==1.25

Based on closed urllib3/urllib3 issue #1462 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Open PR/Commit

@@ -6,6 +6,8 @@ dev (master)
 * Remove quadratic behavior within ``GzipDecoder.decompress()`` (Issue #1467)
 
+* Restored functionality of `ciphers` parameter for `create_urllib3_context()`. (Issue #1462)
+
 * ... [Short description of non-trivial change.] (Issue #)

fix.md

Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: Do not use this fix if you require compatibility with Python versions earlier than 3.6.\n\n

Why This Fix Works in Production

Trigger: The recent change to remove support for Python 2.6 has made it so that the "ciphers" parameter of the create_urllib3_context function in ssl_.py no longer has…
Mechanism: The 'ciphers' parameter was not utilized in the create_urllib3_context function due to incorrect branch marking
Why the fix works: Restored functionality of the 'ciphers' parameter for 'create_urllib3_context()'. (first fixed release: 1.25).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

Triggered by an upgrade/regression window: 2.6 breaks; 1.25 is the first fixed release.
Shows up under Python 2.6 in real deployments (not just unit tests).
The 'ciphers' parameter was not utilized in the create_urllib3_context function due to incorrect branch marking
Production symptom (often without a traceback): The recent change to remove support for Python 2.6 has made it so that the "ciphers" parameter of the create_urllib3_context function in ssl_.py no longer has any effect. The parameter is unused for the rest of the function.

Proof / Evidence

GitHub issue: #1462
Fix PR: https://github.com/urllib3/urllib3/pull/1463
First fixed release: 1.25
Affected versions: 2.6
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.76

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“I see what happened here, the branch for that piece of code was incorrectly marked as being for Python 2.6 only but actually was for…”

@sethmlarson · 2018-10-23 · source

Failure Signature (Search String)

The recent change to remove support for Python 2.6 has made it so that the "ciphers" parameter of the create_urllib3_context function in ssl_.py no longer has any effect. The

Copy-friendly signature

signature.txt

Failure Signature
-----------------
The recent change to remove support for Python 2.6 has made it so that the "ciphers" parameter of the create_urllib3_context function in ssl_.py no longer has any effect.  The parameter is unused for the rest of the function.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
The recent change to remove support for Python 2.6 has made it so that the "ciphers" parameter of the create_urllib3_context function in ssl_.py no longer has any effect.  The parameter is unused for the rest of the function.

Environment

Python: 2.6

What Broke

Users could not specify ciphers, leading to potential security vulnerabilities.

Why It Broke

The 'ciphers' parameter was not utilized in the create_urllib3_context function due to incorrect branch marking

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.25

When NOT to use: Do not use this fix if you require compatibility with Python versions earlier than 3.6.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/1463

First fixed release: 1.25

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if you require compatibility with Python versions earlier than 3.6.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
2.6	Broken
1.25	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

urllib3 Can no longer create a context with specific ciphers (Fix)