The Fix
pip install urllib3==2.2.0
Based on closed urllib3/urllib3 issue #3268 · PR/commit linked
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS.
diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
index 42b1bbc5e5..0a2a5e04e1 100644
repro.py
nox -s test-3.12
...
FAILED test/with_dummyserver/test_socketlevel.py::TestProxyManager::test_https_proxymanager_connected_to_http_proxy[http] - assert 'Your proxy appears to only use HTTP and not HTTPS' in "('Unable to connect to proxy', SSLError(SSLError(1, '[SSL] record layer failure (_ssl.c:1000)')))"
FAILED test/with_dummyserver/test_socketlevel.py::TestProxyManager::test_https_proxymanager_connected_to_http_proxy[https] - assert 'Your proxy appears to only use HTTP and not HTTPS' in "('Unable to connect to proxy', SSLError(SSLError(1, '[SSL] record layer failure (_ssl.c:1000)')))"
FAILED test/with_dummyserver/test_socketlevel.py::TestSSL::test_ssl_failure_midway_through_conn - AssertionError: Regex pattern did not match.
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==2.2.0\nWhen NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.\n\n
Why This Fix Works in Production
- Trigger: Handle OpenSSL 3.2.0 new error message for unexpected unencrypted records
- Mechanism: Fix handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS.
- Why the fix works: Fix handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. (first fixed release: 2.2.0).
Production impact:
- If left unfixed, this can cause silent data inconsistencies that propagate (bad cache entries, incorrect downstream decisions).
Why This Breaks in Prod
- Shows up under Python 3.12.1 in real deployments (not just unit tests).
- Production symptom (often without a traceback): Handle OpenSSL 3.2.0 new error message for unexpected unencrypted records
Proof / Evidence
- GitHub issue: #3268
- Fix PR: https://github.com/urllib3/urllib3/pull/3271
- First fixed release: 2.2.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.50
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@ecerulm Thanks for reporting this, it looks like OpenSSL 3.2.0 may have changed the error message that gets raised for these cases. I believe extending…”
“Just to be clear if I skipped those test manually with -k then it will pass.”
“I've been testing more For the 2 test cases below the issue seems to be timing If at https://github.com/urllib3/urllib3/blob/2ac4efacfef5182aaef3e26a4f1e066ab228dfdd/test/with_dummyserver/test_socketlevel.py#L1252 I add a wait statement then…”
“> @ecerulm Thanks for reporting this, it looks like OpenSSL 3.2.0 may have changed the error message that gets raised for these cases”
Failure Signature (Search String)
- Handle OpenSSL 3.2.0 new error message for unexpected unencrypted records
- * TestSSL::test_ssl_failure_midway_through_conn
Copy-friendly signature
signature.txt
Failure Signature
-----------------
Handle OpenSSL 3.2.0 new error message for unexpected unencrypted records
* TestSSL::test_ssl_failure_midway_through_conn
Error Message
Signature-only (no traceback captured)
error.txt
Error Message
-------------
Handle OpenSSL 3.2.0 new error message for unexpected unencrypted records
* TestSSL::test_ssl_failure_midway_through_conn
Minimal Reproduction
repro.py
nox -s test-3.12
...
FAILED test/with_dummyserver/test_socketlevel.py::TestProxyManager::test_https_proxymanager_connected_to_http_proxy[http] - assert 'Your proxy appears to only use HTTP and not HTTPS' in "('Unable to connect to proxy', SSLError(SSLError(1, '[SSL] record layer failure (_ssl.c:1000)')))"
FAILED test/with_dummyserver/test_socketlevel.py::TestProxyManager::test_https_proxymanager_connected_to_http_proxy[https] - assert 'Your proxy appears to only use HTTP and not HTTPS' in "('Unable to connect to proxy', SSLError(SSLError(1, '[SSL] record layer failure (_ssl.c:1000)')))"
FAILED test/with_dummyserver/test_socketlevel.py::TestSSL::test_ssl_failure_midway_through_conn - AssertionError: Regex pattern did not match.
Environment
- Python: 3.12.1
- urllib3: 2.1.0
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==2.2.0
When NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/3271
First fixed release: 2.2.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use if it changes public behavior or if the failure cannot be reproduced.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 2.2.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.