The Fix
pip install urllib3==1.25
Based on closed urllib3/urllib3 issue #1537 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -22,6 +22,14 @@ dev (master)
``urllib3[brotli]`` extra. (Pull #1532)
+* Add TLSv1.3 support to CPython, pyOpenSSL, and SecureTransport ``SSLContext``
+ implementations. (Pull #1496)
+
asn1crypto==0.24.0
certifi==2018.11.29
cryptography==2.5
ddt==1.2.0
idna==2.8
pyOpenSSL==19.0.0
requests==2.21.0
requests-unixsocket==0.1.5
trustme==0.5.0
urllib3==1.24.1
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: This fix is not applicable if using unsupported versions of OpenSSL or Python.\n\n
Why This Fix Works in Production
- Trigger: OpenSSL.SSL.Error raised with invalid client cert and cryptography 2.5
- Mechanism: Add support for TLS 1.3 to all HTTPSConnection implementations, resolving issues with OpenSSL errors when using invalid client certificates.
- Why the fix works: Add support for TLS 1.3 to all HTTPSConnection implementations, resolving issues with OpenSSL errors when using invalid client certificates. (first fixed release: 1.25).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.7.2 in real deployments (not just unit tests).
- Production symptom (often without a traceback): OpenSSL.SSL.Error raised with invalid client cert and cryptography 2.5
Proof / Evidence
- GitHub issue: #1537
- Fix PR: https://github.com/urllib3/urllib3/pull/1496
- First fixed release: 1.25
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.66
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“This script replicates the issue”
“I'm almost positive this is post-handshake authentication of client certificates.”
Failure Signature (Search String)
- OpenSSL.SSL.Error raised with invalid client cert and cryptography 2.5
- In requests/requests#4961, I stumbled onto an issue where it appears that in the right scenario, OpenSSL errors are raised from
Copy-friendly signature
Failure Signature
-----------------
OpenSSL.SSL.Error raised with invalid client cert and cryptography 2.5
In requests/requests#4961, I stumbled onto an issue where it appears that in the right scenario, OpenSSL errors are raised from `urllib.connectionpool.HTTPConnectionPool._make_request`. It happens with these deps
Error Message
Signature-only (no traceback captured)
Error Message
-------------
OpenSSL.SSL.Error raised with invalid client cert and cryptography 2.5
In requests/requests#4961, I stumbled onto an issue where it appears that in the right scenario, OpenSSL errors are raised from `urllib.connectionpool.HTTPConnectionPool._make_request`. It happens with these deps
Minimal Reproduction
asn1crypto==0.24.0
certifi==2018.11.29
cryptography==2.5
ddt==1.2.0
idna==2.8
pyOpenSSL==19.0.0
requests==2.21.0
requests-unixsocket==0.1.5
trustme==0.5.0
urllib3==1.24.1
Environment
- Python: 3.7.2
What Broke
Users experience SSL errors when making HTTPS requests with invalid client certificates.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==1.25
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/1496
First fixed release: 1.25
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not applicable if using unsupported versions of OpenSSL or Python.
Verify Fix
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.25 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.