urllib3 Retry retries on fruitless ssl ImportError (Fix)

The Fix

pip install urllib3==1.26.10

Based on closed urllib3/urllib3 issue #2589 · PR/commit linked

Production note: This usually shows up under retries/timeouts. Treat it as a side-effect risk until you can verify behavior with a canary + real traffic.

Jump to Verify Open PR/Commit

@@ -1020,7 +1020,7 @@ def _new_conn(self) -> HTTPConnection:
 
         if not self.ConnectionCls or self.ConnectionCls is DummyConnection:  # type: ignore[comparison-overlap]
-            raise SSLError(
+            raise ImportError(
                 "Can't connect to HTTPS URL because the SSL module is not available."

repro.py

Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>> import sys
>> sys.modules["ssl"] = None
>> import requests
>> requests.get("https://google.com")
Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 692, in urlopen
    conn = self._get_conn(timeout=pool_timeout)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 281, in _get_conn
    return conn or self._new_conn()
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1009, in _new_conn
    raise SSLError(
urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/adapters.py", line 440, in send
    resp = conn.urlopen(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 785, in urlopen
    retries = retries.increment(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available."))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/sessions.py", line 529, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/sessions.py", line 645, in send
    r = adapter.send(request, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available."))

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install urllib3==1.26.10\nWhen NOT to use: This fix is not applicable if the SSL module is intentionally disabled for security reasons.\n\n

Why This Fix Works in Production

Trigger: Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux
Mechanism: The SSL module was not available, causing an SSLError to be raised unnecessarily
Why the fix works: Addresses issue #2589 by raising an ImportError instead of an SSLError when the SSL module is not available, preventing unnecessary retries. (first fixed release: 1.26.10).

Production impact:

If left unfixed, retry loops can amplify load and turn a small outage into a cascade (thundering herd).

Why This Breaks in Prod

Shows up under Python 3.10.4 in real deployments (not just unit tests).
The SSL module was not available, causing an SSLError to be raised unnecessarily
Surfaces as: Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux

Proof / Evidence

GitHub issue: #2589
Fix PR: https://github.com/urllib3/urllib3/pull/2656
First fixed release: 1.26.10
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.31

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“Yep, agreed we should be avoiding this if possible”

@nateprewitt · 2022-03-29 · source

“In addition urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available. hides the original error and resulted in a pip user…”

@graingert · 2022-03-29 · source

Failure Signature (Search String)

Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux

Error Message

Stack trace

error.txt

Error Message
-------------
Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>> import sys
>> sys.modules["ssl"] = None
>> import requests
>> requests.get("https://google.com")
Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 692, in urlopen
    conn = self._get_conn(timeout=pool_timeout)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 281, in _get_conn
    return conn or self._new_conn()
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1009, in _new_conn
    raise SSLError(
urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/adapters.py", line 440, in send
    resp = conn.urlopen(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 785, in urlopen
    retries = retries.increment(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxR
... (truncated) ...

Minimal Reproduction

repro.py

Python 3.10.4 (main, Mar 24 2022, 16:12:56) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>> import sys
>> sys.modules["ssl"] = None
>> import requests
>> requests.get("https://google.com")
Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 692, in urlopen
    conn = self._get_conn(timeout=pool_timeout)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 281, in _get_conn
    return conn or self._new_conn()
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1009, in _new_conn
    raise SSLError(
urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/adapters.py", line 440, in send
    resp = conn.urlopen(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/connectionpool.py", line 785, in urlopen
    retries = retries.increment(
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available."))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/sessions.py", line 529, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/sessions.py", line 645, in send
    r = adapter.send(request, **kwargs)
  File "/home/graingert/.virtualenvs/testing310/lib/python3.10/site-packages/requests/adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available."))

Environment

Python: 3.10.4

What Broke

Users experienced MaxRetryError when attempting to connect to HTTPS URLs without SSL support.

Why It Broke

The SSL module was not available, causing an SSLError to be raised unnecessarily

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.26.10

When NOT to use: This fix is not applicable if the SSL module is intentionally disabled for security reasons.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/2656

First fixed release: 1.26.10

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the SSL module is intentionally disabled for security reasons.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
Upgrade behind a canary and run integration tests against the canary before 100% rollout.
Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
1.26.10	Fixed

Related Issues

No related fixes found.

Cluster: urllib3:retry-storm urllib3 hub urllib3 best practices All hubs All clusters

Related clusters: Configuration error Data consistency SSL handshake

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.