{"record":{"id":"7e9ecbe453c018db","repo":"arduino/Arduino","slug":"sslerror-e","errorCode":null,"errorMessage":"SSLError(e)","messagePattern":"SSLError\\(e\\)","errorType":"exception","errorClass":"SSLError","httpStatus":null,"severity":"error","filePath":"arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/connectionpool.py","lineNumber":456,"sourceCode":"            #     ``response.read()``)\n\n        except Empty as e:\n            # Timed out by queue\n            raise TimeoutError(self, \"Request timed out. (pool_timeout=%s)\" %\n                               pool_timeout)\n\n        except SocketTimeout as e:\n            # Timed out by socket\n            raise TimeoutError(self, \"Request timed out. (timeout=%s)\" %\n                               timeout)\n\n        except BaseSSLError as e:\n            # SSL certificate error\n            raise SSLError(e)\n\n        except CertificateError as e:\n            # Name mismatch\n            raise SSLError(e)\n\n        except (HTTPException, SocketError) as e:\n            # Connection broken, discard. It will be replaced next _get_conn().\n            conn = None\n            # This is necessary so we can access e below\n            err = e\n\n            if retries == 0:\n                raise MaxRetryError(self, url, e)\n\n        finally:\n            if release_conn:\n                # Put the connection back to be reused. If the connection is\n                # expired then it will be None, which will get replaced with a\n                # fresh connection during _get_conn.\n                self._put_conn(conn)\n\n        if not conn:","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/connectionpool.py#L438-L474","documentation":"In urllib3's HTTPConnectionPool.urlopen (vendored inside requests), exceptions raised during certificate validation — BaseSSLError and CertificateError (hostname mismatch) — are re-raised as SSLError. It signals the TLS handshake/verification failed before any HTTP exchange completed.","triggerScenarios":"Calling requests via pool.urlopen() when the server certificate is untrusted (self-signed, expired), the CA bundle does not contain the issuer, or the certificate's hostname does not match the requested URL host.","commonSituations":"Corporate MITM proxies with a private CA not added to the trust store; expired or misconfigured certificates; connecting via IP address or wrong hostname; old OpenSSL that cannot parse modern certs; using requests' vendored urllib3 without certifi installed.","solutions":["Add the correct CA chain to your trust bundle (certifi.where() or REQUESTS_CA_BUNDLE/SSL_CERT_FILE env vars) or install the corporate root CA","Fix the URL hostname so it matches the certificate's CN/SAN","Renew or fix the server certificate if you control it","As a last resort (insecure!) pass verify=False / cert_reqs='CERT_NONE' in a controlled environment only","Upgrade requests/urllib3/OpenSSL to versions with current CA handling"],"exampleFix":"// before (fails behind corporate proxy)\nrequests.get('https://internal.example.com/api')\n// after\nimport requests, certifi\nrequests.get('https://internal.example.com/api', verify=certifi.where())  # plus corp root CA in bundle","handlingStrategy":"retry","validationCode":"import ssl\ntry:\n    ctx = ssl.create_default_context(cafile=certifi.where())\n    with socket.create_connection((host, 443)) as sock:\n        with ctx.wrap_socket(sock, server_hostname=host): pass\nexcept ssl.SSLError as e:\n    print('cert problem:', e)  # fix bundle/hostname before the real request","typeGuard":"def host_matches_cert(url_host, cert): \n    return url_host in [s['value'] for s in cert.get('subjectAltName', [])] or url_host == dict(x[0] for x in cert['subject']).get('commonName')","tryCatchPattern":"import requests\nfrom requests.exceptions import SSLError\ntry:\n    r = requests.get(url, timeout=10)\nexcept SSLError as e:\n    # inspect e, refresh CA bundle or fix hostname; do not silently disable verify\n    raise","preventionTips":["Keep certifi and OpenSSL up to date","Install corporate root CAs into the trust bundle rather than verify=False","Use the exact DNS hostname from the certificate, never an IP","Monitor certificate expiry"],"tags":["python","ssl","tls","network"],"backgroundTag":"ssl-certificate-error","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}