Elasticsearch-py: urllib3 1.25 breaks ssl verification when verify_certs=False

[jrobison-sb]

Our code:

Elasticsearch(os.environ['ELASTICSEARCH_URL'],
                             verify_certs=False, timeout=60)

When our underlying pip3 package of urllib3 is at 1.24.2, the above works great.

When we use urllib3 1.25, it breaks with the following error:

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)

Considering that urllib3 changed the way that SSL verification works by default in 1.25, I suspect that either Elasticsearch isn't correctly passing verify_certs=False to urllib3, or urllib3 isn't honoring it, or something...

I don't know for sure if this is an elasticsearch-py problem or a urllib3 problem, but since my goal is to use Elasticsearch, I figured I should start here. Thanks.

OS: Debian Stretch, in a docker container
Python: 3.5.3
Elasticsearch python package: 7.0.0
Elasticsearch server: 6.2, using AWS's managed Elasticsearch service

[vtermanis]

Shameless bump - hopefully addressed by #987

[jolyj]

I had the problem here, the only fix was to downgrade to 1.24.2 to make urllib3 ignore certificate verification

[mlcdf]

I had the problem here, the only fix was to downgrade to 1.24.2 to make urllib3 ignore certificate verification

Thank for the workaround!

[vtermanis]

@HonzaKral - is the fix going to be backported to the ES6 branch of this package?

[mccarthyp-snet]

I downgraded urllib3 to 1.24.2 and I'm still getting sslv3 alert bad certificate.

Python: 3.8.0
Python client for Elasticsearch: 6.8.0
Elasticsearch: 6.2.3