title: tls1.2 handshake on tls1 record python ssl
body: <p>I've been trying to create a TLSv1.2 connection to a server with python's <code>ssl</code> module. I was able to change the handshake tls version to the one I wanted (TLSv1.2). But no matter how I tried to set up my SSLContext, I only able to create a Client Hello with a TLSv1 record layer. </p>
  
  <p>I saw <a href="https://github.com/openssl/openssl/issues/1689" rel="nofollow noreferrer">this issue</a> that made me understand why I was failing but I'm quite stuck now. Because the server I'm trying to connect to only accept TLSv1.2 record layers and immediately ends the connection without error message if it is not. So is there a hidden way to change the record layer version or shall I look into other languages for more flexible implementation/try to do my own whacky implementation ?</p>
  
  <p><code>ssl.OPENSSL_VERSION</code> returns <code>OpenSSL 1.1.0j  20 Nov 2018</code> and I am running python 3.7.2</p>
  
  <p>my code:</p>
  
  <pre><code>#!/usr/bin/env python3
  
  import ssl
  import socket
  
  context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
  context.options |= ssl.OP_NO_SSLv3
  context.options |= ssl.OP_NO_TLSv1
  context.options |= ssl.OP_NO_TLSv1_1
  context.set_ciphers("AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA")
  context.options |= ssl.OP_NO_COMPRESSION
  context.verify_mode = ssl.CERT_REQUIRED
  
  s = socket.socket(socket.AF_INET)
  
  conn = context.wrap_socket(s, server_hostname="address")
  
  conn.connect(('address', 443))
  
  conn.close()
  </code></pre>
  
  <p>Thanks!</p>