Python PIP and InsecurePlatformWarning

Question

I'm trying to install requests library for Python (2.6.6 on CentOS6) as

sudo pip install requests[security]

I'm getting these error messages:

/usr/lib/python2.6/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
Collecting requests[security]
/usr/lib/python2.6/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
/usr/lib/python2.6/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning

I ensured all system libraries are in place

sudo yum install openssl-devel python-devel libffi-devel

and all is good there

so I tried

sudo pip install pyopenssl ndg-httpsclient pyasn1

and

sudo pip install --trusted-host pypi.python.org requests

and these fail as well.

Due to some old code I need to stick to Python 2.6

Any idea what is going wrong here and how to address it?

PS

I have decided to downgrade pip and it came up that errors came up with pip version 6.1+. Thoughts on that?

Did you mean "sudo pip install requests[security]" instead of "sudo pip install requests[secure]"? If that is the case, this may help you: https://stackoverflow.com/questions/31811949/pip-install-requestssecurity-vs-pip-install-requests-difference/31812342 — Armando Perez, Sep 26 '18 at 13:13
The error message has a link to [this page](https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings) that tells you to use [this recommendations](https://urllib3.readthedocs.io/en/latest/user-guide.html#ssl-py2) to fix it (in particular they say to `pip install urllib3[secure]` or manually install `pyOpenSSL`, `certifi`, `idna` and `cryptography`. Which part of this process did not work for you since you are asking this question? — Giacomo Alzetta, Sep 26 '18 at 13:20

stop.climatechange.now · Accepted Answer · 2019-02-08T06:22:25.840

Indeed, as of 2019, quite a few people are still facing this issue, as they cannot upgrade their system Python (and system-supplied openssl) due to various limitations.

If you'd like to fix the InsecurePlatformWarning .. (Caused by SSLError .. SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version'), the following solution can help someone using an old Linux distro:

Unable to install Python packages using pip in Ubuntu Linux: InsecurePlatformWarning, SSLError, tlsv1 alert protocol version

Python 2.6.6 on CentOS6

In your specific case, the last cryptography version to officially support Python 2.6 was cryptography-2.1.1, although a newer version might work. The first manylinux1 cryptography package to include its own OpenSSL (1.1.0f) shared lib binding for Linux, regardless of what's on your platform, has appeared in cryptography-2.0 version. The last cryptography that still officially supported Centos 6.4 was version 1.8.2, while newer versions officially supported CentOS 7.x only: https://pypi.org/project/cryptography/#files

Note, cryptography versions<2.0 have no manylinux1 and didn't ship the openssl/ssllib with them, relying on the system-supplied one only (back then, they did so only for other OSes that had/have even bigger SSL problems). While the cryptography-2.0 (manylinux1) is still worth trying, you will probably have to compile the newer openssl version (1.0.1 - 1.1.0) locally on Centos 6.x, before compiling cryptography 1.8.2 to link against it:
https://cryptography.io/en/latest/installation/#using-your-own-openssl-on-linux
https://cryptography.io/en/latest/installation/#rhel-centos

There is also an option to build your own statically-linked wheels that will work on your own systems:
https://cryptography.io/en/latest/installation/#static-wheels

That said,

if all you needed was just to install the requests lib (without solving the notorious SSLError), specifically in Python 2.6.6 on CentOS6, and you are not going to need TLS 1.2 protocol support from requests, you could simply use your Centos repo for that:

$ yum search requests
$ sudo yum install python26-requests

Or, you could get and install requests in a similar way as in the above-mentioned solution, from wheels or from tar.gz downloaded from: https://pypi.org/project/requests/

Note, the latest requests on PyPI depends on the following Python packages: urllib3, idna, chardet, certifi

Luckily, these four have no other dependencies and can be obtained from PyPI directly, in the same way - the "Download Files" section on PyPI:
https://pypi.org/project/urllib3/
https://pypi.org/project/idna/
https://pypi.org/project/chardet/
https://pypi.org/project/certifi/

You could download and try to install their latest versions, or use 'Release History' section to locate older versions, depending on your use-case and system-specific requirements.

Note, many web servers (including PyPI) nowadays require TLS 1.2 support, both in the client and server backend, to establish an HTTPS connection, so if you will need this type of connections, requests will not work without fixing the SSLError the way discussed above (or by compiling a newer Python 2.7.9+ against OpenSSL version 1.0.2+ that would have to be compiled as well in that case, before compiling new Python, to link ssl module with it).

score 0 · Answer 2 · answered Sep 26 '18 at 13:14

0

Try this:

sudo pip install requests

[secure] is not necessary

answered Sep 26 '18 at 13:14

Kirito

19
4

Well, I have done that as first attempt to install it then found at the StackOverflow similar issues with answers which are not working for me so I have posted my issue above. – JackTheKnife Sep 26 '18 at 13:18
Ok. Before you did that. Did you run: pip install --upgrade pip. Maybe your pip is to old for the newest version? – Kirito Sep 26 '18 at 13:21
1

`Requirement already up-to-date: pip in /usr/lib/python2.6/site-packages` Funny is I have other machine with the `pip` version 1.3.1 and `pip install` works there – JackTheKnife Sep 26 '18 at 13:22
Have a look at [stackoverflow_link](https://stackoverflow.com/a/18345890/8868822) .Aktually you can try to install it manually – Kirito Sep 26 '18 at 13:27
You can also try this: python -m pip install requests – Kirito Sep 26 '18 at 13:28
`/usr/bin/python: pip is a package and cannot be directly executed` – JackTheKnife Sep 26 '18 at 13:30
I have decided to try to downgrade `pip` to some version which is going to work – JackTheKnife Sep 26 '18 at 13:46
Ok, or you upgrade python to 3.7. – Kirito Sep 26 '18 at 14:03

Python PIP and InsecurePlatformWarning

2 Answers2