title: SSLError: bad handshake, Python requests
body: <p>I am consuming <a href="http://developer.ebay.com/devzone/xml/docs/reference/ebay/index.html" rel="nofollow">Ebay Trading APIs</a> using <a href="https://github.com/timotheus/ebaysdk-python" rel="nofollow">Ebay python sdk</a> which is eventually sing <a href="https://github.com/kennethreitz/requests" rel="nofollow">python-requests</a> for making API calls.</p>
  
  <p>All was working fine, but since last few days I am unable to make call. I am getting error:</p>
  
  <pre><code>SSLError: bad handshake: Error([('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')],)
  </code></pre>
  
  <p>Here is complete traceback:</p>
  
  <pre><code>In [9]: response = api.execute('GetSessionID', data)
  ---------------------------------------------------------------------------
  SSLError                                  Traceback (most recent call last)
  &lt;ipython-input-9-eb33610c2a7f&gt; in &lt;module&gt;()
  ----&gt; 1 response = api.execute('GetSessionID', data)
  
  /home/debian/.virtualenvs/myvirtualenv/local/lib/python2.7/site-packages/ebaysdk/connection.pyc in execute(self, verb, data, list_nodes, verb_attrs, files)
      117
      118         self.build_request(verb, data, verb_attrs, files)
  --&gt; 119         self.execute_request()
      120
      121         if hasattr(self.response, 'content'):
  
  /home/debian/.virtualenvs/goplaces/local/lib/python2.7/site-packages/ebaysdk/connection.pyc in execute_request(self)
      182             proxies=self.proxies,
      183             timeout=self.timeout,
  --&gt; 184             allow_redirects=True
      185         )
      186
  
  /home/debian/.virtualenvs/myvirtualenv/local/lib/python2.7/site-packages/requests/sessions.pyc in send(self, request, **kwargs)
      574
      575         # Send the request
  --&gt; 576         r = adapter.send(request, **kwargs)
      577
      578         # Total elapsed time of the request (approximately)
  
  /home/debian/.virtualenvs/myvirtualenv/local/lib/python2.7/site-packages/requests/adapters.pyc in send(self, request, stream, timeout, verify, cert, proxies)
      431         except (_SSLError, _HTTPError) as e:
      432             if isinstance(e, _SSLError):
  --&gt; 433                 raise SSLError(e, request=request)
      434             elif isinstance(e, ReadTimeoutError):
      435                 raise ReadTimeout(e, request=request)
  
  SSLError: bad handshake: Error([('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')],)
  </code></pre>
  
  <p>There are many related question on StackOverflow, all which says:</p>
  
  <ol>
  <li>pass argument verify=False</li>
  <li>pass CA certificate</li>
  <li>append you CA certificate in <a href="https://github.com/kennethreitz/requests/blob/master/requests/cacert.pem" rel="nofollow">cacert.pem file</a>  (I tried this, didn't work)</li>
  </ol>
  
  <p>I can not do this because:</p>
  
  <ol>
  <li>requests is being called by third-party library which is in my virtualenvirinent.</li>
  <li>This is bad in security point of view.</li>
  </ol>
  
  <p>Also,</p>
  
  <ol>
  <li>I am able to make other TSL calls  (e.g.  Amazon marketplace apis) in the same virtualenv using requests, which not causing bad handshake or any other SSL errors.</li>
  <li>Ebay SDK is working fine on my local system(Mac OsX), issue is only with my production server (Google Cloud/Debian)</li>
  <li>There are no SSL errors reported by chrome on my domain</li>
  </ol>
  
  <p>I have no knowledge why this is happening. </p>
  
  <p>Why <code>SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed'</code> is in traceback, when I have disabled SSL3. (I have no deep knowledge about SSL).</p>
  
  <p>Thank you!</p>
  
  <h2>Edit:</h2>
  
  <pre><code># openssl version
  OpenSSL 1.0.2e 3 Dec 2015
  </code></pre>
  
  <p>Upgraded to openssl 1.0.2 from 1.0.1 by building from source after @Steffen Ullrich's suggestion.</p>
  
  <pre><code>$ pip freeze | grep -i ssl
  backports.ssl-match-hostname==3.4.0.2
  pyOpenSSL==0.15.1
  </code></pre>