Python requests module using TLSv1.2 even though I am specifying TLSv1.1

Question

Our payment processing partner can only support TLSv1.1 for the time being. Switching processors is not an option right now.

In Python 2.7.10, I have a script which requests a GET from my dev web server, but at runtime it uses TLSv1.2 instead of TLSv1.1 like I am telling it to.

import requests
from requests.packages.urllib3.poolmanager import PoolManager
import ssl


class MyAdapter(requests.adapters.HTTPAdapter):
    def init_poolmanager(self, connections, maxsize, block=False):
        self.poolmanager = PoolManager(
            num_pools=connections,
            maxsize=maxsize,
            block=block,
            ssl_version=ssl.PROTOCOL_TLSv1_1,
        )
        print("poolmanager set")


def do_it():
    with requests.Session() as s:
        s.mount('https://', MyAdapter())
        url = 'https://my.server.com/api/3.0/order/?page=1&limit=10'
        response = requests.get(url, verify=True)
        print("status code: %r" % response.status_code)


if __name__ == '__main__':
    print do_it()

The output is:

poolmanager set
status code: 200

My nginx access log, however, says that the protocol used was TLSv1.2:

127.0.0.1 - [15/Dec/2015:13:38:19 -0600] TLSv1.2/ECDHE-RSA-AES128-GCM-SHA256 "GET /api/3.0/order/?page=1&limit=10 HTTP/1.1" 200 176 "-" "python-requests/2.9.0"

I have poured over the skint documentation around implementing and mounting HTTPAdapters with the requests library, and I cannot find anything that would indicate why my client is speaking TLSv1.2 instead of TLSv1.1 like I am telling it to.

Answer 1

The solution is to use s.get (the Session with the mounted HTTPAdapter) instead of requests.get.