5

I am using Python requests on a client to make a TLS connection to a server. This is the code that i am using:

import ssl
import requests

from requests.adapters import HTTPAdapter
from requests.packages.urllib3.poolmanager import PoolManager
from requests.packages.urllib3.util import ssl_

CIPHERS = (
    'RSA+AES'
)

class TlsAdapter(HTTPAdapter):

    def __init__(self, ssl_options=0, **kwargs):
        self.ssl_options = ssl_options
        super(TlsAdapter, self).__init__(**kwargs)

    def init_poolmanager(self, *pool_args, **pool_kwargs):
        ctx = ssl_.create_urllib3_context(ciphers=CIPHERS, cert_reqs=ssl.CERT_REQUIRED, options=self.ssl_options)
        print(ssl.PROTOCOL_TLS)
        self.poolmanager = PoolManager(*pool_args,
                                       ssl_context=ctx,
                                       **pool_kwargs)

session = requests.session()
adapter = TlsAdapter(ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1)
session.mount("https://", adapter)
r = session.request('GET', 'https://awesome.com', verify='/etc/ssl/certs/ca-certificates.crt')
print(r)

When i examine the client hello message in Wireshark, i see an additional cipher "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" in the list of ciphers provided by the client.

Can anyone tell me what this cipher is and what it does? Is there a way to remove this from the list of ciphers being sent in the client hello message?

I tried looking up this issue but could not find a suitable answer.

Thanks!

Hussain Ali Akbar
  • 1,585
  • 2
  • 16
  • 28
  • 1
    The relevant part is in a comment to the answer I've marked as duplicate: *"As the RFC says: 'This SCSV is not a true cipher suite (it does not correspond to any valid set of algorithms) and cannot be negotiated'. So there is no way for it to be used for the session. You only have one other, so that is selected."* – Steffen Ullrich Feb 07 '18 at 13:24
  • Hi @SteffenUllrich, thanks for the help in finding out a duplicate question. I couldn't find that one! The information that you have provided is good enough. Thanks again! – Hussain Ali Akbar Feb 09 '18 at 06:07

0 Answers0