urllib3 1.25 breaks ssl verification when verify_certs=False

Our code:

Elasticsearch(os.environ['ELASTICSEARCH_URL'],
                             verify_certs=False, timeout=60)

When our underlying pip3 package of urllib3 is at 1.24.2, the above works great.

When we use urllib3 1.25, it breaks with the following error:

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)

Considering that urllib3 changed the way that SSL verification works by default in 1.25, I suspect that either Elasticsearch isn’t correctly passing verify_certs=False to urllib3, or urllib3 isn’t honoring it, or something…

I don’t know for sure if this is an elasticsearch-py problem or a urllib3 problem, but since my goal is to use Elasticsearch, I figured I should start here. Thanks.

OS: Debian Stretch, in a docker container Python: 3.5.3 Elasticsearch python package: 7.0.0 Elasticsearch server: 6.2, using AWS’s managed Elasticsearch service

[vtermanis]

@HonzaKral - is the fix going to be backported to the ES6 branch of this package?

[jolyj]

I had the problem here, the only fix was to downgrade to 1.24.2 to make urllib3 ignore certificate verification