The Fix
pip install urllib3==1.25
Based on closed urllib3/urllib3 issue #750 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -162,6 +162,12 @@ def test_http_with_ssl_keywords(self):
self.assertEqual(r.status, 200)
+ def test_http_with_ca_cert_dir(self):
+ http = PoolManager(ca_certs='REQUIRED', ca_cert_dir='/nosuchdir')
+
repro.py
>> import urllib3
>> p = urllib3.PoolManager(ca_cert_dir='/usr/local/etc/openssl')
>> p.urlopen('GET', 'http://http2bin.org/get')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "urllib3/poolmanager.py", line 162, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "urllib3/connectionpool.py", line 548, in urlopen
conn = self._get_conn(timeout=pool_timeout)
File "urllib3/connectionpool.py", line 250, in _get_conn
return conn or self._new_conn()
File "urllib3/connectionpool.py", line 211, in _new_conn
strict=self.strict, **self.conn_kw)
File "urllib3/connection.py", line 121, in __init__
_HTTPConnection.__init__(self, *args, **kw)
TypeError: __init__() got an unexpected keyword argument 'ca_cert_dir'
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: This fix should not be used if 'ca_cert_dir' is intended for secure connections only.\n\n
Why This Fix Works in Production
- Trigger: >> import urllib3
- Mechanism: The 'ca_cert_dir' keyword argument was not included in the SSL_KEYWORDS block, causing errors in HTTP connections
- Why the fix works: Added 'ca_cert_dir' to the SSL_KEYWORDS in poolmanager.py to prevent accidental passing to HTTPConnectionPool. (first fixed release: 1.25).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- The 'ca_cert_dir' keyword argument was not included in the SSL_KEYWORDS block, causing errors in HTTP connections
- Surfaces as: >> import urllib3
Proof / Evidence
- GitHub issue: #750
- Fix PR: https://github.com/urllib3/urllib3/pull/758
- First fixed release: 1.25
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.42
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“This should also make sure to update the new tests in #751 to include the ca_cert_dir field.”
Failure Signature (Search String)
- >> import urllib3
Error Message
Stack trace
error.txt
Error Message
-------------
>> import urllib3
>> p = urllib3.PoolManager(ca_cert_dir='/usr/local/etc/openssl')
>> p.urlopen('GET', 'http://http2bin.org/get')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "urllib3/poolmanager.py", line 162, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "urllib3/connectionpool.py", line 548, in urlopen
conn = self._get_conn(timeout=pool_timeout)
File "urllib3/connectionpool.py", line 250, in _get_conn
return conn or self._new_conn()
File "urllib3/connectionpool.py", line 211, in _new_conn
strict=self.strict, **self.conn_kw)
File "urllib3/connection.py", line 121, in __init__
_HTTPConnection.__init__(self, *args, **kw)
TypeError: __init__() got an unexpected keyword argument 'ca_cert_dir'
Minimal Reproduction
repro.py
>> import urllib3
>> p = urllib3.PoolManager(ca_cert_dir='/usr/local/etc/openssl')
>> p.urlopen('GET', 'http://http2bin.org/get')
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "urllib3/poolmanager.py", line 162, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "urllib3/connectionpool.py", line 548, in urlopen
conn = self._get_conn(timeout=pool_timeout)
File "urllib3/connectionpool.py", line 250, in _get_conn
return conn or self._new_conn()
File "urllib3/connectionpool.py", line 211, in _new_conn
strict=self.strict, **self.conn_kw)
File "urllib3/connection.py", line 121, in __init__
_HTTPConnection.__init__(self, *args, **kw)
TypeError: __init__() got an unexpected keyword argument 'ca_cert_dir'
What Broke
Passing 'ca_cert_dir' to HTTPConnectionPool results in a TypeError during plaintext HTTP connections.
Why It Broke
The 'ca_cert_dir' keyword argument was not included in the SSL_KEYWORDS block, causing errors in HTTP connections
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==1.25
When NOT to use: This fix should not be used if 'ca_cert_dir' is intended for secure connections only.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/758
First fixed release: 1.25
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix should not be used if 'ca_cert_dir' is intended for secure connections only.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.25 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.