The Fix
pip install urllib3==1.25
Based on closed urllib3/urllib3 issue #890 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -1 +0,0 @@
@@ -1 +0,0 @@
-cacert.pem
\ No newline at end of file
diff --git a/dummyserver/certs/ca_path_test/98a2772e.0 b/dummyserver/certs/ca_path_test/98a2772e.0
fix.md
Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: This fix is not applicable if symlinks are required for other environments.\n\n
Why This Fix Works in Production
- Trigger: py27 runtests: commands[1] | nosetests
- Mechanism: The test fails on Windows due to symlink issues with CA cert files
- Why the fix works: Removed symlinks from dummyserver certs to fix test suite on Windows. (first fixed release: 1.25).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 2.7.11 in real deployments (not just unit tests).
- The test fails on Windows due to symlink issues with CA cert files
- Surfaces as: py27 runtests: commands[1] | nosetests
Proof / Evidence
- GitHub issue: #890
- Fix PR: https://github.com/urllib3/urllib3/pull/891
- First fixed release: 1.25
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.19
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“I'll need to spin up a Windows VM to dive into this, so unless someone else on the team with access to a Windows box…”
“Please note that using pysocks 1.5.7 things get a lot worse.”
“@haikuginger Good spot! Probably best to get rid of the symlink and copy the files into place.”
“@mindw Mind trying again with the current master?”
Failure Signature (Search String)
- py27 runtests: commands[1] | nosetests
Error Message
Stack trace
error.txt
Error Message
-------------
py27 runtests: commands[1] | nosetests
SSSINFO:urllib3.connectionpool:Starting new HTTPS connection (1): localhost
INFO:tornado.access:200 GET / (::1) 2.00ms
DEBUG:urllib3.connectionpool:"GET / HTTP/1.1" 200 13
......E..........E..S........................................................................................................E..........S..S..........................................SSS......S..............................................................................................................................................................................................................
======================================================================
ERROR: test_ca_dir_verified (test.contrib.test_pyopenssl.TestHTTPS)
----------------------------------------------------------------------
Traceback (most recent call last):
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\__init__.py", line 66, in wrapper
return test(*args, **kwargs)
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\with_dummyserver\test_https.py", line 101, in test_ca_dir_verified
r = https_pool.request('GET', '/')
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\urllib3\request.py", line 69,
in request
**urlopen_kw)
File "J:\dev\workspace\pythonxy-xy-27\src\pyth
... (truncated) ...
Stack trace
error.txt
Error Message
-------------
SSS......E..........E..S........................................................................................................E..........S..S............................................................................................S.................................................S...................................................................................................................
======================================================================
ERROR: test_ca_dir_verified (test.contrib.test_pyopenssl.TestHTTPS)
----------------------------------------------------------------------
Traceback (most recent call last):
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\__init__.py", line 66, in wrapper
return test(*args, **kwargs)
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\with_dummyserver\test_https.py", line 101, in test_ca_dir_verified
r = https_pool.request('GET', '/')
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\urllib3\request.py", line 69,
in request
**urlopen_kw)
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\urllib3\request.py", line 90,
in request_encode_url
return self.urlopen(method, url, **extra_kw)
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace
... (truncated) ...
Stack trace
error.txt
Error Message
-------------
......E..........E..S..........................j:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\.tox\py35\lib\site-packages\nose\util.py:453: DeprecationWarning: inspect.getargspec() is deprecated, use
inspect.signature() instead
inspect.getargspec(func)
..............................................................................E..........S..S............................................................................................S.................................................S...................................................................................................................
======================================================================
ERROR: test_ca_dir_verified (test.contrib.test_pyopenssl.transplant_class.<locals>.C)
----------------------------------------------------------------------
Traceback (most recent call last):
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\__init__.py", line 66, in wrapper
return test(*args, **kwargs)
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\test\with_dummyserver\test_https.py", line 101, in test_ca_dir_verified
r = https_pool.request('GET', '/')
File "J:\dev\workspace\pythonxy-xy-27\src\python\urllib3\__workspace__\urllib3-git\urllib3\request.py", line 69,
in request
**urlopen_kw)
F
... (truncated) ...
Environment
- Python: 2.7.11
What Broke
Tests fail on Windows, leading to CI pipeline failures.
Why It Broke
The test fails on Windows due to symlink issues with CA cert files
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
pip install urllib3==1.25
When NOT to use: This fix is not applicable if symlinks are required for other environments.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/urllib3/urllib3/pull/891
First fixed release: 1.25
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not applicable if symlinks are required for other environments.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
- Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.25 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.