SSLCertVerificationError can be handled by RequestError

[nkhitrov]

I use the AsyncClient.request() method to call one of the internal services. Today due to Kubernetes configuration error I got SSLCertVerificationError.

I was very surprised because there is a RequestError exception handling in the code. The description of this error says that it can catch all possible errors:

Base class for all exceptions that may occur when issuing a `.request()`

Why this ssl error is not handled in the same way as connection errors?
Maybe this behaviour should be changed?

[lovelydinosaur]

Why this ssl error is not handled in the same way as connection errors?

Where would you look first to answer this question?

What other information do you have available that might help you resolve this?

[nkhitrov]

we also use opentelemetry httpx instrumentation, but it should not affect the request

[nkhitrov]

@tomchristie hi! What do you think about this issue? Can I make a PR with fix?

[lovelydinosaur]

Can I make a PR with fix?

Yes. We could choose to use ConnectError for this, so long as it includes proper error details.

[nkhitrov]

I read httpx and httpcore code and I think we should add OSError to exception mapping here like in sync backend.

[lovelydinosaur]

That looks correct to me, yep.

[lahwaacz]

This is a problem also because the behavior is different for AsyncClient (gives ssl.SSLError or its subclass) and Client (gives httpx.ConnectError). Consider these repro cases:

1. sync version:

import httpx
import ssl
ssl_context = httpx.create_ssl_context(ssl.PROTOCOL_TLS)
ssl_context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1_2 | ssl.OP_NO_TLSv1_3
client = httpx.Client(verify=ssl_context)
client.get("https://www.howsmyssl.com/a/check")

gives httpx.ConnectError: [SSL: NO_PROTOCOLS_AVAILABLE] no protocols available (_ssl.c:997)

2. async version:

import asyncio
import httpx
import ssl
ssl_context = httpx.create_ssl_context(ssl.PROTOCOL_TLS)
ssl_context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1_2 | ssl.OP_NO_TLSv1_3
client = httpx.AsyncClient(verify=ssl_context)
async def main():
    await client.get("https://www.howsmyssl.com/a/check")
loop = asyncio.get_event_loop()
loop.run_until_complete(main())

gives ssl.SSLError: [SSL: NO_PROTOCOLS_AVAILABLE] no protocols available (_ssl.c:997)