title: ssl.SSLError: [SSL: SSLV3_ALERT_BAD_RECORD_MAC] sslv3 alert bad record mac
body: <p>What I am trying to do is write this code that will pull down a certificate from the device and parse it out. This code works against some devices, but against others I get this error</p>
  
  <pre><code>PS C:\NetDevOps&gt; &amp; "C:/Program Files (x86)/Python38-32/python.exe" c:/NetDevOps/Cert/test6a.py
  Traceback (most recent call last):
    File "c:/NetDevOps/Cert/test6a.py", line 17, in &lt;module&gt;
      pull = ssl.get_server_certificate((phoneip, 443))
    File "C:\Program Files (x86)\Python38-32\lib\ssl.py", line 1484, in get_server_certificate
      with context.wrap_socket(sock) as sslsock:
    File "C:\Program Files (x86)\Python38-32\lib\ssl.py", line 500, in wrap_socket
      return self.sslsocket_class._create(
    File "C:\Program Files (x86)\Python38-32\lib\ssl.py", line 1040, in _create
      self.do_handshake()
    File "C:\Program Files (x86)\Python38-32\lib\ssl.py", line 1309, in do_handshake
      self._sslobj.do_handshake()
  ssl.SSLError: [SSL: SSLV3_ALERT_BAD_RECORD_MAC] sslv3 alert bad record mac (_ssl.c:1108)
  </code></pre>
  
  <p>and here is my code:</p>
  
  <pre><code>import ssl
  import OpenSSL.crypto
  
  phonelist = ["10.129.157.30"]
  
  for phoneip in phonelist:
      pull = ssl.get_server_certificate((phoneip, 443))
      x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, pull)
  
  output = open(str('C:/NetDevOps/Cert/certs.txt'), 'a+')
  output.write(str(phoneip) + ' Certificate' + '\n')
  output.write('Issuer: ' + str(x509.get_issuer()) + '\n')
  output.write('Serial Number (cert): ' + str(x509.get_serial_number()) + '\n')
  output.write('Subject: ' + str(x509.get_subject()) + '\n')
  output.write('Not Valid Before: ' + str(x509.get_notBefore()) + '\n')
  output.write('Not Valid After: ' + str(x509.get_notAfter()) + '\n')
  output.write('\n')
  </code></pre>
  
  <p>I've read a bunch of SO articles about similar related to certificate verification failing, however the above code is using the method described as a fix to that issue. Essentially pulling the cert using ssl.get_server_certificate, but then parsing the pem via OpenSSL.crypto.load_certificate, but alas no luck on the failure devices, even though the code does work against some devices.</p>
  
  <p>Any thoughts?</p>