arduino/Arduino · error · SSLError

SSLError(e)

Error message

SSLError(e)

What it means

In urllib3's HTTPConnectionPool.urlopen (vendored inside requests), exceptions raised during certificate validation — BaseSSLError and CertificateError (hostname mismatch) — are re-raised as SSLError. It signals the TLS handshake/verification failed before any HTTP exchange completed.

Source

Thrown at arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/connectionpool.py:456

            #     ``response.read()``)

        except Empty as e:
            # Timed out by queue
            raise TimeoutError(self, "Request timed out. (pool_timeout=%s)" %
                               pool_timeout)

        except SocketTimeout as e:
            # Timed out by socket
            raise TimeoutError(self, "Request timed out. (timeout=%s)" %
                               timeout)

        except BaseSSLError as e:
            # SSL certificate error
            raise SSLError(e)

        except CertificateError as e:
            # Name mismatch
            raise SSLError(e)

        except (HTTPException, SocketError) as e:
            # Connection broken, discard. It will be replaced next _get_conn().
            conn = None
            # This is necessary so we can access e below
            err = e

            if retries == 0:
                raise MaxRetryError(self, url, e)

        finally:
            if release_conn:
                # Put the connection back to be reused. If the connection is
                # expired then it will be None, which will get replaced with a
                # fresh connection during _get_conn.
                self._put_conn(conn)

        if not conn:

View on GitHub (pinned to a0df6e0e83)

Solutions

1. Add the correct CA chain to your trust bundle (certifi.where() or REQUESTS_CA_BUNDLE/SSL_CERT_FILE env vars) or install the corporate root CA
2. Fix the URL hostname so it matches the certificate's CN/SAN
3. Renew or fix the server certificate if you control it
4. As a last resort (insecure!) pass verify=False / cert_reqs='CERT_NONE' in a controlled environment only
5. Upgrade requests/urllib3/OpenSSL to versions with current CA handling

Example fix

// before (fails behind corporate proxy)
requests.get('https://internal.example.com/api')
// after
import requests, certifi
requests.get('https://internal.example.com/api', verify=certifi.where())  # plus corp root CA in bundle

import ssl
try:
    ctx = ssl.create_default_context(cafile=certifi.where())
    with socket.create_connection((host, 443)) as sock:
        with ctx.wrap_socket(sock, server_hostname=host): pass
except ssl.SSLError as e:
    print('cert problem:', e)  # fix bundle/hostname before the real request

def host_matches_cert(url_host, cert): 
    return url_host in [s['value'] for s in cert.get('subjectAltName', [])] or url_host == dict(x[0] for x in cert['subject']).get('commonName')

import requests
from requests.exceptions import SSLError
try:
    r = requests.get(url, timeout=10)
except SSLError as e:
    # inspect e, refresh CA bundle or fix hostname; do not silently disable verify
    raise

When it happens

Trigger: Calling requests via pool.urlopen() when the server certificate is untrusted (self-signed, expired), the CA bundle does not contain the issuer, or the certificate's hostname does not match the requested URL host.

Common situations: Corporate MITM proxies with a private CA not added to the trust store; expired or misconfigured certificates; connecting via IP address or wrong hostname; old OpenSSL that cannot parse modern certs; using requests' vendored urllib3 without certifi installed.

Related errors

• Can't connect to HTTPS URL because the SSL module is not ava
• empty or no certificate
• hostname %r doesn't match either of %s
• MaxRetryError(self, url, e)
• hostname %r doesn't match %r

AI-assisted analysis of arduino/Arduino@a0df6e0e83 (2026-09-06). Data as JSON: /api/errors/7e9ecbe453c018db. Report an issue: GitHub.