Python-zeep: Issue with SSL Handshake on SSLv3.

[dhinchakdhoom]

As I checked with requests module of Python3. I can successfully make request to the WSDL Url with following response.

>>> response = requests.get(url,cert=('/home/user/Desktop/certificate.pem','/home/user/Desktop/keyplain.pem'),verify=True)
>>> print(response.status_code)
200

Where as if I am using the same certificate and key for authentication using zeep I am getting the following error

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/dist-packages/urllib3/contrib/pyopenssl.py", line 438, in wrap_socket
    cnx.do_handshake()
  File "/usr/local/lib/python3.5/dist-packages/OpenSSL/SSL.py", line 1638, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/usr/local/lib/python3.5/dist-packages/OpenSSL/SSL.py", line 1378, in _raise_ssl_error
    _raise_current_error()
  File "/usr/local/lib/python3.5/dist-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py", line 345, in _make_request
    self._validate_conn(conn)
  File "/usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py", line 844, in _validate_conn
    conn.connect()
  File "/usr/local/lib/python3.5/dist-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/local/lib/python3.5/dist-packages/urllib3/util/ssl_.py", line 325, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/local/lib/python3.5/dist-packages/urllib3/contrib/pyopenssl.py", line 445, in wrap_socket
    raise ssl.SSLError('bad handshake: %r' % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')],)",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/dist-packages/requests/adapters.py", line 440, in send
    timeout=timeout
  File "/usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py", line 630, in urlopen
    raise SSLError(e)
urllib3.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')],)",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.5/dist-packages/zeep/client.py", line 123, in __init__
    self.wsdl = Document(wsdl, self.transport, strict=strict)
  File "/usr/local/lib/python3.5/dist-packages/zeep/wsdl/wsdl.py", line 79, in __init__
    document = self._get_xml_document(location)
  File "/usr/local/lib/python3.5/dist-packages/zeep/wsdl/wsdl.py", line 140, in _get_xml_document
    location, self.transport, self.location, strict=self.strict)
  File "/usr/local/lib/python3.5/dist-packages/zeep/loader.py", line 69, in load_external
    content = transport.load(url)
  File "/usr/local/lib/python3.5/dist-packages/zeep/transports.py", line 111, in load
    content = self._load_remote_data(url)
  File "/usr/local/lib/python3.5/dist-packages/zeep/transports.py", line 126, in _load_remote_data
    response = self.session.get(url, timeout=self.load_timeout)
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 515, in get
    return self.request('GET', url, **kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 502, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/sessions.py", line 612, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.5/dist-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')],)",)

Also one more thing that I would like to highlight a point here from the documentation of requests here in below link:

http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification

It says that the client key should not be encrypted whereas in documentation I can see that there is an optional password that's not working for me with version 2.2.0.
Is this because request is not supported ?

http://docs.python-zeep.org/en/master/wsse.html

[mvantellingen]

You are confusing Wsse x509 with the https cerificate. You can pass a request session to the zeep transport which had the https cert set

[dhinchakdhoom]

You are confusing Wsse x509 with the https cerificate.
[DD] : This confusing me a lot I didn't get you on this point.
You can pass a request session to the zeep transport which had the https cert set.
[DD] : An example code would be helpful.
I used the below code:(May be this could be wrong)
`
from requests import Session

from zeep import Client

from zeep.transports import Transport

s = requests.Session()

s. get(url,cert=('/home/user/Desktop/certificate.pem','/home/user/Desktop/keyplain.pem'),verify=True)

transport = Transport(session=s)

client = Client(url,transport=transport)
`

[mvantellingen]

See http://docs.python-zeep.org/en/master/transport.html#transports

So in your case, something like

session = Session()
session.cert = ('/home/user/Desktop/certificate.pem','/home/user/Desktop/keyplain.pem')
transport = Transport(session=session)
client = Client(wsdl_url, transport=transport)

[dhinchakdhoom]

Ok
It's good you closed this Issue but I am still confused with your statement

"You are confusing Wsse x509 with the https cerificate."

If you could clarify on this it would be good for me to get a better refrence.
I have a p12 certificate from which I had extracted the pem certificate from it using the following code:{code reference: https://github.com/requests/requests/issues/1573#issuecomment-188125157}

//here you can find the link 
// Generate the certificate file.
openssl pkcs12 -in /path/to/p12cert -nokeys -out certificate.pem
// Generate private key with passpharse, First enter the password provided with the key and then an arbitrary PEM password //(say: 1234) 
openssl pkcs12 -in /path/to/p12cert -nocerts -out key.pem
//Generate key without passphrase.
// Running this command will prompt for the pem password(1234), on providing which we will obtain the plainkey.pem
openssl rsa -in key.pem -out keyplain.pem

Using this key & certificate I can communicate with proper SSL Handshake.
But if I use same certificate and key in zeep I am getting the above mentioned exception.