MacOS: Connecting to a local .net web api fails.

[Luc1412]

The following python application works flawless with the same configuration on Windows.

I got a Mac with Python 3.10 setup. I also installed certificates after installing Python, so aiohttp works fine when connecting to external services like Discord.com's API trough the discord.py library.

I build a .net web api, which I want to use in my py app. This .net app issues a TLSv2 SSL cert for localhost. Testing the api trough Postman works fine.

When using this api in my app with a default session I get ClientConnectorSSLError(ConnectionKey(host='127.0.0.1', port=5067, is_ssl=True, ssl=None, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)')).
I also tried creating a session with ssl verification disabled: connector=aiohttp.TCPConnector(verify_ssl=sys.platform != 'darwin'). This also results in the same error.

Any thoughts on how to solve that?

[Dreamsorcerer]

No idea, but if you look at the traceback, I think you'll see the original exception comes from the ssl module. So, maybe widening your search to issues in Python's ssl module might provide more luck in figuring out the problem.

[webknjaz]

I'd say set up the TLS context properly to trust that certificate instead of disabling the verification. Could use trustme in tests, like us.

[webknjaz]

WRONG_VERSION_NUMBER

This probably means that the TLS version supported by the server is not enabled in the client's TLS context. IIRC there's been some changes in the TLS versions enabled by default in the recent CPython's but one would need to check the changelogs.

[webknjaz]

I think this should be solvable by providing own SSLContext instance constructed with the vulnerable TLS versions enabled.

[Dreamsorcerer]

I'd say set up the TLS context properly to trust that certificate instead of disabling the verification.

Also worth pointing out that there is no such thing as disabling verification. That option just "relaxes" the verification (i.e. allows self-signed certs) using a SSLContext (

aiohttp/aiohttp/connector.py

Lines 896 to 910 in 12f56d7

	sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
	sslcontext.options |= ssl.OP_NO_SSLv2
	sslcontext.options |= ssl.OP_NO_SSLv3
	sslcontext.check_hostname = False
	sslcontext.verify_mode = ssl.CERT_NONE
	try:
	sslcontext.options |= ssl.OP_NO_COMPRESSION
	except AttributeError as attr_err:
	warnings.warn(
	"{!s}: The Python interpreter is compiled "
	"against OpenSSL < 1.0.0. Ref: "
	"https://docs.python.org/3/library/ssl.html"
	"#ssl.OP_NO_COMPRESSION".format(attr_err),
	)
	sslcontext.set_default_verify_paths()

). So, if something even less restrictive is needed, then passing a SSLContext with your exact requirements is necessary.