blocks|key|1375826|text|我在Linux上也遇到了同样的错误(当服务器不支持"RFC+5746安全重新协商“而客户端使用OpenSSL+3+(默认情况下强制执行该标准)时就会发生这种情况)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1375827|这里有一个解决方案(您可能需要稍微调整一下)。|1375828|在Python代码中导入ssl和urllib3|ordered-list-item|offset|length|style|CODE|1375829|创建一个使用自定义ssl+Context的自定义Context|1375830|class+CustomHttpAdapter+(requests.adapters.HTTPAdapter):
++++'''Transport+adapter"+that+allows+us+to+use+custom+ssl_context.'''

++++def+__init__(self,+ssl_context=None,+**kwargs):
++++++++self.ssl_context+=+ssl_context
++++++++super().__init__(**kwargs)

++++def+init_poolmanager(self,+connections,+maxsize,+block=False):
++++++++self.poolmanager+=+urllib3.poolmanager.PoolManager(
++++++++++++num_pools=connections,+maxsize=maxsize,
++++++++++++block=block,+ssl_context=self.ssl_context)|code-block|syntax|javascript|1375831|设置一个启用ssl的OP_LEGACY_SERVER_CONNECT上下文，并与您的自定义适配器一起使用。|1375832|ssl.OP_LEGACY_SERVER_CONNECT在Python中还不可用(https://bugs.python.org/issue44888)。但是，在OpenSSL中，它在位字段中的值是0x4。这样我们就可以做下面的事。|1375833|ctx+=+ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
ctx.options+%7C=+0x4
session.mount('https://',+CustomHttpAdapter(ctx))|1375834|entityMap|0|LINK|mutability|MUTABLE|url|https://bugs.python.org/issue44888^0|0|0|C|3|G|7|0|9|3|D|7|O|7|0|0|6|3|A|O|0|0|S|15|Y|0|0|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|16|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|17|8|@$G|18|H|19|I|J]|$G|1A|H|1B|I|J]]|9|@]|A|$]]|$1|K|3|L|5|F|7|1C|8|@$G|1D|H|1E|I|J]|$G|1F|H|1G|I|J]|$G|1H|H|1I|I|J]]|9|@]|A|$]]|$1|M|3|N|5|O|7|1J|8|@]|9|@]|A|$P|Q]]|$1|R|3|S|5|F|7|1K|8|@$G|1L|H|1M|I|J]|$G|1N|H|1O|I|J]]|9|@]|A|$]]|$1|T|3|U|5|6|7|1P|8|@$G|1Q|H|1R|I|J]]|9|@$G|1S|H|1T|1|1U]]|A|$]]|$1|V|3|W|5|O|7|1V|8|@]|9|@]|A|$P|Q]]|$1|X|3|-4|5|6|7|1W|8|@]|9|@]|A|$]]]|Y|$Z|$5|10|11|12|A|$13|14]]]]

I hit the same error on Linux (it happens when the server doesn't support &quot;RFC 5746 secure renegotiation&quot; and the client is using OpenSSL 3, which enforces that standard by default).
Here is a solution (you may have to adjust it slightly).
<ol>
<li>Import <code>ssl</code> and <code>urllib3</code> in your Python code</li>
<li>Create a custom HttpAdapter which uses a custom <code>ssl</code> <code>Context</code></li>
</ol>
<pre class="lang-py prettyprint-override"><code>class CustomHttpAdapter (requests.adapters.HTTPAdapter):
 '''Transport adapter&quot; that allows us to use custom ssl_context.'''

 def __init__(self, ssl_context=None, **kwargs):
 self.ssl_context = ssl_context
 super().__init__(**kwargs)

 def init_poolmanager(self, connections, maxsize, block=False):
 self.poolmanager = urllib3.poolmanager.PoolManager(
 num_pools=connections, maxsize=maxsize,
 block=block, ssl_context=self.ssl_context)
</code></pre>
<ol start="3">
<li>Set up an <code>ssl</code> context which enables <code>OP_LEGACY_SERVER_CONNECT</code>, and use it with your custom adapter.</li>
</ol>
<code>ssl.OP_LEGACY_SERVER_CONNECT</code> is not available in Python yet (<a href="https://bugs.python.org/issue44888" rel="noreferrer">https://bugs.python.org/issue44888</a>). However it turns out that in OpenSSL its value is 0x4 in the bitfield. So we can do the following.
<pre><code>ctx = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
ctx.options |= 0x4
session.mount('https://', CustomHttpAdapter(ctx))
</code></pre>

blocks|key|1390037|text|CVE-2009-3555.警告:当启用遗产不安全重新协商时，SSL连接将容易受到中描述的中间人前缀攻击的攻击。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1390038|借助https://bugs.launchpad.net/bugs/1963834和https://bugs.launchpad.net/ubuntu/%2Bsource/gnutls28/%2Bbug/1856428|1390039|请注意，不建议编辑系统的openssl.conf，因为一旦openssl更新，您可能会丢失更改。|1390040|在任何目录中创建一个具有以下内容的自定义openssl.cnf文件：|CODE|1390041|openssl_conf+=+openssl_init

[openssl_init]
ssl_conf+=+ssl_sect

[ssl_sect]
system_default+=+system_default_sect

[system_default_sect]
Options+=+UnsafeLegacyRenegotiation|code-block|syntax|javascript|1390042|在运行程序之前，请确保在运行刮板时将OPENSSL_CONF环境变量设置为自定义openssl.cnf完整路径，如下所示：|1390043|OPENSSL_CONF=/path/to/custom/openssl.cnf+python+your_scraper.py|1390044|大概是这样的：|1390045|export+OPENSSL_CONF=/path/to/custom/openssl.cnf
python+your_scraper.py|1390046|或者，如果您正在使用pipenv、systemd或docker，请将其放入您的.env文件中。|1390047|OPENSSL_CONF=/path/to/custom/openssl.cnf|1390048|entityMap|0|LINK|mutability|MUTABLE|url|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555|1|https://bugs.launchpad.net/bugs/1963834|2|https://bugs.launchpad.net/ubuntu/%2Bsource/gnutls28/%2Bbug/1856428^0|D|1|0|D|0|0|2|13|1|16|1R|2|0|0|K|B|0|0|I|C|14|B|0|0|0|0|13|4|0|0^^$0|@$1|2|3|4|5|6|7|1F|8|@$9|1G|A|1H|B|C]]|D|@$9|1I|A|1J|1|1K]]|E|$]]|$1|F|3|G|5|6|7|1L|8|@]|D|@$9|1M|A|1N|1|1O]|$9|1P|A|1Q|1|1R]]|E|$]]|$1|H|3|I|5|6|7|1S|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|1T|8|@$9|1U|A|1V|B|L]]|D|@]|E|$]]|$1|M|3|N|5|O|7|1W|8|@]|D|@]|E|$P|Q]]|$1|R|3|S|5|6|7|1X|8|@$9|1Y|A|1Z|B|L]|$9|20|A|21|B|L]]|D|@]|E|$]]|$1|T|3|U|5|O|7|22|8|@]|D|@]|E|$P|Q]]|$1|V|3|W|5|6|7|23|8|@]|D|@]|E|$]]|$1|X|3|Y|5|O|7|24|8|@]|D|@]|E|$P|Q]]|$1|Z|3|10|5|6|7|25|8|@$9|26|A|27|B|L]]|D|@]|E|$]]|$1|11|3|12|5|O|7|28|8|@]|D|@]|E|$P|Q]]|$1|13|3|-4|5|6|7|29|8|@]|D|@]|E|$]]]|14|$15|$5|16|17|18|E|$19|1A]]|1B|$5|16|17|18|E|$19|1C]]|1D|$5|16|17|18|E|$19|1E]]]]

WARNING: When enabling Legacy Unsafe Renegotiation, SSL connections will be vulnerable to the Man-in-the-Middle prefix attack as described in <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555" rel="noreferrer">CVE-2009-3555</a>.
With the help of <a href="https://bugs.launchpad.net/bugs/1963834" rel="noreferrer">https://bugs.launchpad.net/bugs/1963834</a>
and <a href="https://bugs.launchpad.net/ubuntu/+source/gnutls28/+bug/1856428" rel="noreferrer">https://bugs.launchpad.net/ubuntu/+source/gnutls28/+bug/1856428</a>
Beware that editing your system's openssl.conf is not recommended, because you might lose your changes once openssl is updated.
Create a custom <code>openssl.cnf</code> file in any directory with these contents:
<pre><code>openssl_conf = openssl_init

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Options = UnsafeLegacyRenegotiation
</code></pre>
Before running your program, make sure your <code>OPENSSL_CONF</code> environment variable is set to your custom <code>openssl.cnf</code> full path when running the scraper like so:
<pre><code>OPENSSL_CONF=/path/to/custom/openssl.cnf python your_scraper.py
</code></pre>
or like so:
<pre><code>export OPENSSL_CONF=/path/to/custom/openssl.cnf
python your_scraper.py
</code></pre>
or, if you are using pipenv or systemd or docker, place this into your <code>.env</code> file
<pre><code>OPENSSL_CONF=/path/to/custom/openssl.cnf
</code></pre>

blocks|key|1390054|text|当使用OpenSSL+3连接到不支持它的服务器时，会出现此错误。解决方案是降低python中的加密包的级别：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1390055|在使用过的环境中运行pip+install+cryptography==36.0.2。|offset|length|style|CODE|1390056|来源：https://github.com/scrapy/scrapy/issues/5491|1390057|编辑:参考Hally+Mallon和阿姆卡拉的答案，在不降低密码学等级的情况下修复|1390058|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/scrapy/scrapy/issues/5491^0|0|A|W|0|3|18|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@$D|V|E|W|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@$D|Y|E|Z|1|10]]|A|$]]|$1|J|3|K|5|6|7|11|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]]]

This error comes up when using OpenSSL 3 to connect to a server which does not support it. The solution is to downgrade the cryptography package in python:
run <code>pip install cryptography==36.0.2</code> in the used enviroment.
source: <a href="https://github.com/scrapy/scrapy/issues/5491" rel="nofollow noreferrer">https://github.com/scrapy/scrapy/issues/5491</a>
EDIT: Refer to Hally Mallon and ahmkara's answer for a fix without downgrading cryptography

blocks|key|1390087|text|哈里·马伦答案的完整代码片段：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1390088|定义用于重用的方法：|1390089|import+requests
import+urllib3
import+SSL


class+CustomHttpAdapter+(requests.adapters.HTTPAdapter):
++++#+"Transport+adapter"+that+allows+us+to+use+custom+ssl_context.

++++def+__init__(self,+ssl_context=None,+**kwargs):
++++++++self.ssl_context+=+ssl_context
++++++++super().__init__(**kwargs)

++++def+init_poolmanager(self,+connections,+maxsize,+block=False):
++++++++self.poolmanager+=+urllib3.poolmanager.PoolManager(
++++++++++++num_pools=connections,+maxsize=maxsize,
++++++++++++block=block,+ssl_context=self.ssl_context)


def+get_legacy_session():
++++ctx+=+ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
++++ctx.options+%7C=+0x4++#+OP_LEGACY_SERVER_CONNECT
++++session+=+requests.session()
++++session.mount('https://',+CustomHttpAdapter(ctx))
++++return+session|code-block|syntax|javascript|1390090|然后使用它来代替请求调用：|1390091|get_legacy_session().get("some-url")|1390092|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/5394228/harry-mallon^0|0|5|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|11|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|12|8|@]|9|@]|C|$]]|$1|M|3|N|5|H|7|13|8|@]|9|@]|C|$I|J]]|$1|O|3|-4|5|6|7|14|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]]]

Complete code snippets for <a href="https://stackoverflow.com/users/5394228/harry-mallon">Harry Mallon</a>'s answer:
Define a method for reuse:
<pre><code>import requests
import urllib3
import SSL


class CustomHttpAdapter (requests.adapters.HTTPAdapter):
 # &quot;Transport adapter&quot; that allows us to use custom ssl_context.

 def __init__(self, ssl_context=None, **kwargs):
 self.ssl_context = ssl_context
 super().__init__(**kwargs)

 def init_poolmanager(self, connections, maxsize, block=False):
 self.poolmanager = urllib3.poolmanager.PoolManager(
 num_pools=connections, maxsize=maxsize,
 block=block, ssl_context=self.ssl_context)


def get_legacy_session():
 ctx = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
 ctx.options |= 0x4 # OP_LEGACY_SERVER_CONNECT
 session = requests.session()
 session.mount('https://', CustomHttpAdapter(ctx))
 return session
</code></pre>
Then use it in place of the requests call:
<pre><code>get_legacy_session().get(&quot;some-url&quot;)
</code></pre>

I am running a Python code where I have to get some data from HTTPSConnectionPool(host='ssd.jpl.nasa.gov', port=443). But every time I try to run the code I get the following error. I am on MAC OS 12.1
<pre><code>raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='ssd.jpl.nasa.gov', port=443): Max retries exceeded with url: /api/horizons.api?format=text&amp;EPHEM_TYPE=OBSERVER&amp;QUANTITIES_[...]_ (Caused by SSLError(SSLError(1, '[SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled (_ssl.c:997)')))
</code></pre>
I really don't know how to bypass this issue.. thank you for the help!

SSL error unsafe legacy renegotiation disabled

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我正在运行Python代码，其中必须从HTTPSConnectionPool(host='ssd.jpl.nasa.gov'，port=443)获取一些数据。但是每次我试图运行代码时，我都会得到以下错误。我在MAC操作系统12.1上raise SSLError(e, request=request)requests.e...

问不安全的旧版重新协商禁用SSL错误
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问不安全的旧版重新协商禁用SSL错误EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问不安全的旧版重新协商禁用SSL错误
EN