SSL Certificate validation Urllib2

Question

I was trying to access webpages which has expired/invalid certs. When I access the URL from browser, I get the security warning Your connection is not private. But when I use python to access the same page, I am not getting any error. The code I used is below,

import urllib2
url  = 'https://expired.badssl.com/' 
request = urllib2.Request(url) 
result = urllib2.urlopen(request)     
print (result.read())

Why am I not getting SSL cert error in urllib2?

UPDATE

I identified that the page which is downloaded was my internet authentication page.

But when I use requests I am getting SSL exception. why urllib2 behaviour is different from requests behaviour?

user_315507 · Answer

Python prior 2.7.9 have not verified certificates.

Python 2.7.9 includes a number of network security enhancements that have been approved for inclusion in Python 2.7 maintenance releases. PEP 476 changes several standard library modules, like httplib, urllib2, and xmlrpclib, to by default verify certificates presented by servers over secure (TLS) connections.

from 2.7.14 installation notes.

Also see

PEP 476 – Enabling certificate verification by default for HTTPS
PEP 493 – HTTPS verification migration tools for Python 2.7
Documentation for ssl._https_verify_certificates https://docs.python.org/2.7/library/ssl.html#ssl._https_verify_certificates

SSL Certificate validation Urllib2

1 Answers