{"id":"71487353ecf56bac","repo":"aio-libs/aiohttp","slug":"cannot-connect-to-host-host-port-ssl-ssl-s","errorCode":null,"errorMessage":"Cannot connect to host {host}:{port} ssl:{ssl} [{strerror}]","messagePattern":"Cannot connect to host (.+?):(.+?) ssl:(.+?) \\[(.+?)\\]","errorType":"exception","errorClass":"ClientConnectorSSLError","httpStatus":null,"severity":"error","filePath":"aiohttp/connector.py","lineNumber":1349,"sourceCode":"                    addr_infos=addr_infos,\n                    local_addr_infos=self._local_addr_infos,\n                    happy_eyeballs_delay=self._happy_eyeballs_delay,\n                    interleave=self._interleave,\n                    loop=self._loop,\n                    socket_factory=self._socket_factory,\n                )\n                # Add ssl_shutdown_timeout for Python 3.11+ when SSL is used\n                if (\n                    kwargs.get(\"ssl\")\n                    and self._ssl_shutdown_timeout\n                    and sys.version_info >= (3, 11)\n                ):\n                    kwargs[\"ssl_shutdown_timeout\"] = self._ssl_shutdown_timeout\n                return await create_connection(self._loop, *args, **kwargs, sock=sock)\n        except cert_errors as exc:\n            raise ClientConnectorCertificateError(req.connection_key, exc) from exc\n        except ssl_errors as exc:\n            raise ClientConnectorSSLError(req.connection_key, exc) from exc\n        except OSError as exc:\n            if exc.errno is None and isinstance(exc, asyncio.TimeoutError):\n                raise\n            raise client_error(req.connection_key, exc) from exc\n\n    def _warn_about_tls_in_tls(\n        self,\n        underlying_transport: asyncio.Transport,\n        req: ClientRequest,\n    ) -> None:\n        \"\"\"Issue a warning if the requested URL has HTTPS scheme.\"\"\"\n        if req.url.scheme != \"https\":\n            return\n\n        # TLS-in-TLS only applies when the proxy itself is HTTPS.\n        # When the proxy is HTTP, start_tls upgrades a plain TCP connection,\n        # which is standard TLS and works on all event loops and Python versions.\n        if req.proxy is None or req.proxy.scheme != \"https\":","sourceCodeStart":1331,"sourceCodeEnd":1367,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/connector.py#L1331-L1367","documentation":"Raised inside _wrap_create_connection() when the TLS handshake raises an `ssl_errors` exception (ssl.SSLError / ssl.SSLError subclasses that are not certificate errors) during a direct connection. Wrapped as ClientConnectorSSLError(req.connection_key, exc). Typically indicates a protocol/cipher mismatch or handshake abort rather than a certificate-trust problem.","triggerScenarios":"Server supports only outdated TLS versions/ciphers, the SSLContext is misconfigured (e.g. min/max version wrong), the server abruptly closed the socket during handshake, or a non-TLS service answered on port 443.","commonSituations":"Forcing TLSv1.0 on a TLSv1.3-only server. Restrictive cipher suite on the client. Connecting plain HTTP to an HTTPS URL/port. Middleboxes terminating TLS incorrectly. Old OpenSSL linked into Python.","solutions":["Verify the URL scheme matches what the server speaks (`http://` vs `https://`).","Inspect the wrapped OSError via `traceback.print_exc()` for the SSL reason string.","Adjust the SSLContext min/max version and cipher list to what the server supports.","Update the Python/OpenSSL build if the failure is `unsupported protocol`."],"exampleFix":"# before\nctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)\nctx.maximum_version = ssl.TLSVersion.TLSv1\n# after\nctx = ssl.create_default_context()\nctx.minimum_version = ssl.TLSVersion.TLSv1_2","handlingStrategy":"try-catch","validationCode":"import ssl\n\ndef modern_tls_context() -> ssl.SSLContext:\n    ctx = ssl.create_default_context()\n    ctx.minimum_version = ssl.TLSVersion.TLSv1_2\n    return ctx","typeGuard":null,"tryCatchPattern":"from aiohttp import ClientConnectorSSLError\ntry:\n    await session.get(url, ssl=ctx)\nexcept ClientConnectorSSLError as e:\n    # log e.__cause__ for the OpenSSL reason string\n    raise","preventionTips":["Default to ssl.create_default_context() unless you have a specific reason to restrict it.","Verify URL scheme matches the service (http vs https) before issuing.","Keep your Python/OpenSSL build current to avoid obsolete protocol ceilings."],"tags":["connector","ssl","tls","handshake","client"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}