title: python 2.7.5 requests and certificate verify failed
body: <p>I am having trouble using python's request package to submit GET request to
  Puppet 3.7's REST API.  I have looked at this documentation here:</p>
  
  <p><a href="http://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification" rel="nofollow">http://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification</a></p>
  
  <p>But I am still having trouble.  Here is my script:</p>
  
  <pre><code>[root@ppt-001 RESTClients]# cat add-group.py
  #!/usr/bin/env python
  
  import requests
  
  # curl https://ppt-001.example.com:4433/classifier-api/v1/groups \
  # -H "Content-Type: application/json" \
  # --cert /etc/puppetlabs/puppet/ssl/certs/ppt-001.example.com.pem \
  # --key /etc/puppetlabs/puppet/ssl/private_keys/ppt-001.example.com.pem \
  # --cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem | python -m json.tool
  
  url='https://ppt-001.example.com:4433/classifier-api/v1/groups'
  headers = {"Content-Type": "application/json"}
  data={}
  cacert='/etc/puppetlabs/puppet/ssl/certs/ca.pem'
  key='/etc/puppetlabs/puppet/ssl/private_keys/ppt-001.example.com.pem'
  cert='/etc/puppetlabs/puppet/ssl/certs/ppt-001.example.com.pem'
  result = requests.get(url,
          data=data, #no data needed for this request
          headers=headers, #dict {"Content-Type":"application/json"}
          cert=(cacert,key), #key/cert pair 
          verify=cert
          )
  print result.json()
  </code></pre>
  
  <p>I am using this version of python:</p>
  
  <pre><code>[root@ppt-001 RESTClients]# python -V
  Python 2.7.5
  </code></pre>
  
  <p>Here is what happens when I execute my script:</p>
  
  <pre><code>[root@ppt-001 RESTClients]# ./add-group.py
  /usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
    InsecurePlatformWarning
  Traceback (most recent call last):
    File "./add-group.py", line 21, in &lt;module&gt;
      verify=cert
    File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/api.py", line 69, in get
      return request('get', url, params=params, **kwargs)
    File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/api.py", line 50, in request
      response = session.request(method=method, url=url, **kwargs)
    File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/sessions.py", line 465, in request
      resp = self.send(prep, **send_kwargs)
    File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/sessions.py", line 573, in send
      r = adapter.send(request, **kwargs)
    File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/adapters.py", line 431, in send
      raise SSLError(e, request=request)
  requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  [root@ppt-001 RESTClients]# 
  </code></pre>
  
  <p>I suspect that <code>requests</code> does not like the self-signed cert that Puppet uses, but if I issue this <code>curl</code> command ...</p>
  
  <pre><code>curl https://ppt-001.example.com:4433/classifier-api/v1/groups \
  -H "Content-Type: application/json" \
  --cert /etc/puppetlabs/puppet/ssl/certs/ppt-001.example.com.pem \
  --key /etc/puppetlabs/puppet/ssl/private_keys/ppt-001.example.com.pem \
  --cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem | python -m json.tool
  </code></pre>
  
  <p>... everything works fine.</p>
  
  <p>UPDATE:</p>
  
  <p>I have install <code>requests[security]</code>:</p>
  
  <pre><code>    [root@ppt-001 RESTClients]# pip install requests[security]
      Requirement already satisfied (use --upgrade to upgrade): requests[security] in /usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg
        Installing extra requirements: 'security'
      Requirement already satisfied (use --upgrade to upgrade): pyOpenSSL in /usr/lib64/python2.7/site-packages (from requests[security])
      Downloading/unpacking ndg-httpsclient (from requests[security])
        Downloading ndg_httpsclient-0.4.0.tar.gz
        Running setup.py egg_info for package ndg-httpsclient
  
      Downloading/unpacking pyasn1 (from requests[security])
        Downloading pyasn1-0.1.7.tar.gz (68kB): 68kB downloaded
        Running setup.py egg_info for package pyasn1
  
      Installing collected packages: ndg-httpsclient, pyasn1
        Running setup.py install for ndg-httpsclient
          Skipping installation of /usr/lib/python2.7/site-packages/ndg/__init__.py (namespace package)
  
          Installing /usr/lib/python2.7/site-packages/ndg_httpsclient-0.4.0-py2.7-nspkg.pth
          Installing ndg_httpclient script to /usr/bin
        Running setup.py install for pyasn1
  
      Successfully installed ndg-httpsclient pyasn1
      Cleaning up...
  </code></pre>
  
  <p>But now I get this putput when I run my script:</p>
  
  <pre><code>    [root@ppt-001 RESTClients]# ./add-group.py
      Traceback (most recent call last):
        File "./add-group.py", line 25, in &lt;module&gt;
          verify=cert
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/api.py", line 69, in get
          return request('get', url, params=params, **kwargs)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/api.py", line 50, in request
          response = session.request(method=method, url=url, **kwargs)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/sessions.py", line 465, in request
          resp = self.send(prep, **send_kwargs)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/sessions.py", line 573, in send
          r = adapter.send(request, **kwargs)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/adapters.py", line 370, in send
          timeout=timeout
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/connectionpool.py", line 544, in urlopen
          body=body, headers=headers)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/connectionpool.py", line 341, in _make_request
          self._validate_conn(conn)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/connectionpool.py", line 761, in _validate_conn
          conn.connect()
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/connection.py", line 238, in connect
          ssl_version=resolved_ssl_version)
        File "/usr/lib/python2.7/site-packages/requests-2.7.0-py2.7.egg/requests/packages/urllib3/contrib/pyopenssl.py", line 260, in ssl_wrap_socket
          ctx.use_privatekey_file(keyfile)
      OpenSSL.SSL.Error: [('x509 certificate routines', 'X509_check_private_key', 'key values mismatch')]
  </code></pre>