The Fix
pip install urllib3==2.4.0
Based on closed urllib3/urllib3 issue #3571 · PR/commit linked
Production note: This usually shows up under retries/timeouts. Treat it as a side-effect risk until you can verify behavior with a canary + real traffic.
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Added ``verify_flags`` option to ``create_urllib3_context`` with a default of ``VERIFY_X509_PARTIAL_CHAIN`` and ``VERIFY_X509_STRICT`` for Python 3.13+.
diff --git a/ci/0001-requests-test-cert-key-usage.patch b/ci/0001-requests-test-cert-key-usage.patch
new file mode 100644
Option A — Upgrade to fixed release\npip install urllib3==2.4.0\nWhen NOT to use: Do not use if it changes public behavior or if the failure cannot be reproduced.\n\n
Why This Fix Works in Production
- Trigger: create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT
- Mechanism: Set VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT in create_urllib3_context for Python 3.13+.
- Why the fix works: Set VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT in create_urllib3_context for Python 3.13+. (first fixed release: 2.4.0).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Triggered by an upgrade/regression window: 3.13 breaks; 2.4.0 is the first fixed release.
- Shows up under Python 3.13 in real deployments (not just unit tests).
- Production symptom (often without a traceback): create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT
Proof / Evidence
- GitHub issue: #3571
- Fix PR: https://github.com/urllib3/urllib3/pull/3577
- First fixed release: 2.4.0
- Affected versions: 3.13
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.70
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“> I am wondering if it would make sense to make the change to the default ssl context regardless of the Python version? We know…”
“@RichieB2B thanks for reporting the issue. Would you like to submit a PR setting the flags in create_urllib3_context for Python 3.13+? Also, what do you…”
“I am wondering if it would make sense to make the change to the default ssl context regardless of the Python version?”
“> we are not ready to set the flags for all supported Python versions by default in urllib3 Understood, that makes sense! I see that…”
Failure Signature (Search String)
- create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT
- create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT when `sys.version_info >= (3, 13)`
Copy-friendly signature
Failure Signature
-----------------
create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT
create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT when `sys.version_info >= (3, 13)`
Error Message
Signature-only (no traceback captured)
Error Message
-------------
create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT
create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT when `sys.version_info >= (3, 13)`
Environment
- Python: 3.13
What Broke
Connections to non-RFC 5280 compliant HTTPS servers succeeded unexpectedly.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==2.4.0
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/3577
First fixed release: 2.4.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use if it changes public behavior or if the failure cannot be reproduced.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 3.13 | Broken |
| 2.4.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.