Requests: 'Extensions' object has no attribute 'get_extension_for_class'

[youyanggu]

This occurred after I upgraded form 2.11.1 to 2.12.1. The error occurs arbitrarily for the URLs I tried.

requests.get('http://google.com') # works
requests.get('http://www.google.com') # works
requests.get('https://google.com') # does not work
requests.get('https://www.google.com') # does not work
requests.get('http://amazon.com') # sometimes works
requests.get('http://www.amazon.com') # does not work
requests.get('https://amazon.com') # does not work
requests.get('https://www.amazon.com') # does not work

Below is the error:

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.pyc in _make_request(self, conn, method, url, timeout, chunked, **httplib_request_kw)
    348         # Trigger any extra validation we need to do.
    349         try:
--> 350             self._validate_conn(conn)
    351         except (SocketTimeout, BaseSSLError) as e:
    352             # Py2 raises this as a BaseSSLError, Py3 raises it as socket timeout.

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.pyc in _validate_conn(self, conn)
    833         # Force connect early to allow us to validate the connection.
    834         if not getattr(conn, 'sock', None):  # AppEngine might not have  `.sock`
--> 835             conn.connect()
    836 
    837         if not conn.is_verified:

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connection.pyc in connect(self)
    328         elif context.verify_mode != ssl.CERT_NONE \
    329                 and self.assert_hostname is not False:
--> 330             cert = self.sock.getpeercert()
    331             if not cert.get('subjectAltName', ()):
    332                 warnings.warn((

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/contrib/pyopenssl.pyc in getpeercert(self, binary_form)
    322                 (('commonName', x509.get_subject().CN),),
    323             ),
--> 324             'subjectAltName': get_subj_alt_name(x509)
    325         }
    326 

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/contrib/pyopenssl.pyc in get_subj_alt_name(peer_cert)
    169     # faster than looping in Python)
    170     try:
--> 171         ext = cert.extensions.get_extension_for_class(
    172             x509.SubjectAlternativeName
    173         ).value

AttributeError: 'Extensions' object has no attribute 'get_extension_for_class'

Tried it on Ubuntu/Python 2.7.10 and macOS/Python 2.7.11. I have OpenSSL 1.0.2 for both. Same error on both.

[Lukasa]

What version of cryptography do you have installed please?

[youyanggu]

I have cryptography 1.0.2. Upgrading to the latest 1.5.3 solved the problem. Thanks!

[Lukasa]

No problem! For anyone looking at this issue in future, our minimum cryptography version is currently 1.3.4, and that is expressed in the 'security' extra for requests at this time.

[andreleotorres]

May the gods bless you for this post

[kennethreitz42]

@andreleotorres 🙏🏼