Merge pull request #4210 from Lukasa/sslerror

Make sure we raise SSLError.

HISTORY.rst

@@ -12,6 +12,9 @@ dev
 
 **Bugfixes**
 
+- Fixed issue where Requests would raise ``ConnectionError`` instead of
+  ``SSLError`` when encoutering SSL problems when using urllib3 v1.22.
+
 2.18.2 (2017-07-25)
 +++++++++++++++++++
 

requests/adapters.py

@@ -501,6 +501,10 @@ class HTTPAdapter(BaseAdapter):
             if isinstance(e.reason, _ProxyError):
                 raise ProxyError(e, request=request)
 
+            if isinstance(e.reason, _SSLError):
+                # This branch is for urllib3 v1.22 and later.
+                raise SSLError(e, request=request)
+
             raise ConnectionError(e, request=request)
 
         except ClosedPoolError as e:
@@ -511,6 +515,7 @@ class HTTPAdapter(BaseAdapter):
 
         except (_SSLError, _HTTPError) as e:
             if isinstance(e, _SSLError):
+                # This branch is for urllib3 versions earlier than v1.22
                 raise SSLError(e, request=request)
             elif isinstance(e, ReadTimeoutError):
                 raise ReadTimeout(e, request=request)

tests/test_requests.py

@@ -23,7 +23,7 @@ from requests.cookies import (
 from requests.exceptions import (
     ConnectionError, ConnectTimeout, InvalidSchema, InvalidURL,
     MissingSchema, ReadTimeout, Timeout, RetryError, TooManyRedirects,
-    ProxyError, InvalidHeader, UnrewindableBodyError)
+    ProxyError, InvalidHeader, UnrewindableBodyError, SSLError)
 from requests.models import PreparedRequest
 from requests.structures import CaseInsensitiveDict
 from requests.sessions import SessionRedirectMixin
@@ -812,6 +812,15 @@ class TestRequests:
             item.category.__name__ for item in warning_records)
         assert warnings_category == warnings_expected
 
+    def test_certificate_failure(self, httpbin_secure):
+        """
+        When underlying SSL problems occur, an SSLError is raised.
+        """
+        with pytest.raises(SSLError):
+            # Our local httpbin does not have a trusted CA, so this call will
+            # fail if we use our default trust bundle.
+            requests.get(httpbin_secure('status', '200'))
+
     def test_urlencoded_get_query_multivalued_param(self, httpbin):
 
         r = requests.get(httpbin('get'), params=dict(test=['foo', 'baz']))