Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Proxies should use proxy_ssl_context when connecting via ProxyConfig.use_forwarding_with_https = True

See original GitHub issue

This was discovered in https://github.com/urllib3/urllib3/pull/2558 and discussed with @jalopezsilva on Discord. The gist is it appears that we’re using HTTPSConnection.ssl_context to connect to HTTPS proxies when using use_forwarding_with_https = True mode. This is likely caused by us treating the proxy like it’s the origin when we have proxies in “forwarding” mode and previously we didn’t have a forwarding mode for HTTPS.

Minimum requirements

💵 You can get paid to complete this issue! Please read the docs for more information.

When ProxyConfig.use_forwarding_with_https = True and ssl_context is specified:
- If proxy_ssl_context is specified then error out with ValueError
- If proxy_ssl_context isn’t specified:
  - On 1.26.x emit a DeprecationWarning instructing to switch to proxy_ssl_context and set the value of ssl_context to proxy_ssl_context
  - On 2.x raise a ValueError that proxy_ssl_context should be used, not ssl_context.
Only proxy_ssl_context should be used for creating the connection to proxies in all modes (HTTP->HTTPS, HTTPS->HTTP, HTTPS->HTTPS, in forwarding/tunnel modes).
Remove the skip to test_proxy_https_target_tls_error added in https://github.com/urllib3/urllib3/commit/9f4d05c11eb2f80682c1b7a2671b0636292ef932