The Fix
pip install urllib3==2.2.0
Based on closed urllib3/urllib3 issue #2244 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1,2 @@
@@ -0,0 +1,2 @@
+Fixed issue where requests against urls with trailing dots were failing due to SSL errors
+when using proxy.
\ No newline at end of file
repro.py
import urllib3
proxy = urllib3.ProxyManager('http://someproxy-server.com:8080')
# this works
proxy.request('GET', 'https://github.com')
# this fails
proxy.request('GET', 'https://github.com.')
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==2.2.0\nWhen NOT to use: This fix should not be used if the application relies on trailing dots for hostname resolution.\n\n
Why This Fix Works in Production
- Trigger: >> import urllib3
- Mechanism: The proxy connection did not strip trailing dots from hostnames, causing SSL errors
- Why the fix works: Fixes the issue where requests against URLs with trailing dots were failing due to SSL errors when using a proxy by stripping the trailing dot. (first fixed release: 2.2.0).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.9.0 in real deployments (not just unit tests).
- The proxy connection did not strip trailing dots from hostnames, causing SSL errors
- Surfaces as: >> import urllib3 >>> proxy = urllib3.ProxyManager('http://someproxy-server.com:8080')
Proof / Evidence
- GitHub issue: #2244
- Fix PR: https://github.com/urllib3/urllib3/pull/3183
- First fixed release: 2.2.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.75
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.45
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@achapkowski Can you please open a new issue with more details about your environment? Your problem seems different, even if it's also a TLS issue…”
“@achapkowski @VaniKulkarni You're getting hit by #2400, can you please stop commenting about it here?”
“I am using fiddler to monitor some traffic locally on windows 10 machine”
“Tried to fix this issue in #2874, but found out it is more complicated than expected: A tale of a trailing dot. I also reported…”
Failure Signature (Search String)
- >> import urllib3
Error Message
Stack trace
error.txt
Error Message
-------------
>> import urllib3 >>> proxy = urllib3.ProxyManager('http://someproxy-server.com:8080')
>> proxy.request('GET', 'https://github.com')
<urllib3.response.HTTPResponse object at 0x7fce2ad964c0>
>> proxy.request('GET', 'https://github.com.')
Traceback (most recent call last):
File "/home/mike/bugtest/lib/python3.9/site-packages/urllib3/connectionpool.py", line 696, in urlopen
self._prepare_proxy(conn)
File "/home/mike/bugtest/lib/python3.9/site-packages/urllib3/connectionpool.py", line 964, in _prepare_proxy
conn.connect()
File "/home/mike/bugtest/lib/python3.9/site-packages/urllib3/connection.py", line 464, in connect
_match_hostname(cert, self.assert_hostname or server_hostname)
File "/home/mike/bugtest/lib/python3.9/site-packages/urllib3/connection.py", line 512, in _match_hostname
match_hostname(cert, asserted_hostname)
File "/usr/local/lib/python3.9/ssl.py", line 416, in match_hostname
raise CertificateError("hostname %r "
ssl.SSLCertVerificationError: ("hostname 'github.com.' doesn't match either of 'github.com', 'www.github.com'",)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "<stdin>", line 1,
... (truncated) ...
Minimal Reproduction
repro.py
import urllib3
proxy = urllib3.ProxyManager('http://someproxy-server.com:8080')
# this works
proxy.request('GET', 'https://github.com')
# this fails
proxy.request('GET', 'https://github.com.')
Environment
- Python: 3.9.0
- urllib3: 1.26.4
What Broke
Requests to URLs with trailing dots failed when using a proxy, leading to connection errors.
Why It Broke
The proxy connection did not strip trailing dots from hostnames, causing SSL errors
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==2.2.0
When NOT to use: This fix should not be used if the application relies on trailing dots for hostname resolution.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/3183
First fixed release: 2.2.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix should not be used if the application relies on trailing dots for hostname resolution.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 2.2.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.