<p dir="auto">It seems that every optional parameter that goes into send is also settable on the Session (e.g. verify, stream, etc.).  Except timeout.</p>
<p dir="auto">Would it be possible to change the behaviour so that timeout gets merged in from session just like all the other arguments?</p>
<p dir="auto">Preface: I have a feeling that this isn't an issue with requests itself, but it did up come while I was using it, so I was hoping that you could offer some insight. This issue might even be the same one that hellt had in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="156011291" data-permission-text="Title is private" data-url="https://github.com/psf/requests/issues/3212" data-hovercard-type="issue" data-hovercard-url="/psf/requests/issues/3212/hovercard" href="https://github.com/psf/requests/issues/3212">#3212</a> , but there are a few differences that made me uncertain whether that is actually the case. My apologies if it's a duplicate.</p>
<p dir="auto">The error in question:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Traceback (most recent call last):
  File &quot;ALT_post_api.py&quot;, line 177, in &lt;module&gt;
    main()
  File &quot;ALT_post_api.py&quot;, line 96, in main
    response = requests.get(url, headers=headers, verify=&quot;/path/to/ssl/DigiCertCA.crt&quot;)
  File &quot;/export/software/lib/python2.7/site-packages/requests/api.py&quot;, line 72, in get
    return request('get', url, params=params, **kwargs)
  File &quot;/export/software/lib/python2.7/site-packages/requests/api.py&quot;, line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File &quot;/export/software/lib/python2.7/site-packages/requests/sessions.py&quot;, line 502, in request
    resp = self.send(prep, **send_kwargs)
  File &quot;/export/software/lib/python2.7/site-packages/requests/sessions.py&quot;, line 612, in send
    r = adapter.send(request, **kwargs)
  File &quot;/export/software/lib/python2.7/site-packages/requests/adapters.py&quot;, line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: (&quot;bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)&quot;,)"><pre class="notranslate"><code class="notranslate">Traceback (most recent call last):
  File "ALT_post_api.py", line 177, in &lt;module&gt;
    main()
  File "ALT_post_api.py", line 96, in main
    response = requests.get(url, headers=headers, verify="/path/to/ssl/DigiCertCA.crt")
  File "/export/software/lib/python2.7/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/export/software/lib/python2.7/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/export/software/lib/python2.7/site-packages/requests/sessions.py", line 502, in request
    resp = self.send(prep, **send_kwargs)
  File "/export/software/lib/python2.7/site-packages/requests/sessions.py", line 612, in send
    r = adapter.send(request, **kwargs)
  File "/export/software/lib/python2.7/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",)
</code></pre></div>
<p dir="auto">Looking at the Apache config, an SSLCertificateFile, an SSLCertificateKeyFile, and an SSLCertificateChainFile are specified. The above uses the SSLCertificateChainFile (DigiCertCA.crt) in the verify parameter, though both True and the SSLCertificateFile throw the same exact error. I tried appending those two files to a copy of the file given by <code class="notranslate">certifi.where()</code> (named cacert.pem) as seems to be suggested in the linked issue, but it also throws the same error.</p>
<p dir="auto">Versions:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Python 2.7.12
&gt;&gt;&gt; requests.__version__
'2.18.1'
&gt;&gt;&gt; certifi.__version__
'2017.04.17'
&gt;&gt;&gt; ssl.OPENSSL_VERSION
'OpenSSL 1.0.1e-fips 11 Feb 2013'"><pre class="notranslate"><code class="notranslate">Python 2.7.12
&gt;&gt;&gt; requests.__version__
'2.18.1'
&gt;&gt;&gt; certifi.__version__
'2017.04.17'
&gt;&gt;&gt; ssl.OPENSSL_VERSION
'OpenSSL 1.0.1e-fips 11 Feb 2013'
</code></pre></div>
<p dir="auto">This is the result of running <code class="notranslate">openssl s_client -connect my_host:443 -showcerts -servername my_host</code>, HOWEVER, I later ran openssl version and got OpenSSL 0.9.8za 5 Jun 2014; this isn't the version Python is using:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="CONNECTED(00000003)
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3980 bytes and written 329 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: 400E[etc]
    Session-ID-ctx:
    Master-Key: E536[etc.]
    Key-Arg   : None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - b7 23 f5 ed a7 6c 9a 56-09 c2 ac 32 11 6e 5c c6   .#...l.V...2.n\.

    Start Time: 1503002301
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---"><pre class="notranslate"><code class="notranslate">CONNECTED(00000003)
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3980 bytes and written 329 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: 400E[etc]
    Session-ID-ctx:
    Master-Key: E536[etc.]
    Key-Arg   : None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - b7 23 f5 ed a7 6c 9a 56-09 c2 ac 32 11 6e 5c c6   .#...l.V...2.n\.

    Start Time: 1503002301
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
</code></pre></div>
<p dir="auto">But specifying -CAfile with the SSLCertificateFile, DigiCertCA.crt, or cacert.pem returns '0 (ok)':</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="depth=2 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
verify return:1
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3980 bytes and written 329 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: 0EFE[etc.]
    Session-ID-ctx:
    Master-Key: 856A[etc.]
    Key-Arg   : None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - 1e 0c ac a4 32 6d 57 6b-64 19 32 69 6b 62 a4 f3   ....2mWkd.2ikb..

    Start Time: 1503002938
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---"><pre class="notranslate"><code class="notranslate">depth=2 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
verify return:1
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 /C=US/ST=[redacted; local area + host]
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3980 bytes and written 329 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: 0EFE[etc.]
    Session-ID-ctx:
    Master-Key: 856A[etc.]
    Key-Arg   : None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - 1e 0c ac a4 32 6d 57 6b-64 19 32 69 6b 62 a4 f3   ....2mWkd.2ikb..

    Start Time: 1503002938
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
</code></pre></div>
<p dir="auto">Now for the output of the OpenSSL version that Python is actually using:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="CONNECTED(00000003)
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 3980 bytes and written 492 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: D4AD[redacted]
    Session-ID-ctx:
    Master-Key: 7732[redacted]
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - 3f ff 52 7a 03 a7 ee f3-7f d0 f0 ae f2 b3 46 a0   ?.Rz..........F.

    Start Time: 1503072674
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)"><pre class="notranslate"><code class="notranslate">CONNECTED(00000003)
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = US, ST = [redacted; local area + host]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=[redacted; local area + host]
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
-----BEGIN CERTIFICATE-----
MIIFmzC[redacted]
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-----BEGIN CERTIFICATE-----
MIIGWDC[redacted]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=[redacted; local area + host]
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 3980 bytes and written 492 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES128-SHA
    Session-ID: D4AD[redacted]
    Session-ID-ctx:
    Master-Key: 7732[redacted]
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket:
    0000 - 48 39 0b 54 3d 88 e3 bf-69 71 ac ea 7e aa fe 9a   H9.T=...iq..~...
    [etc.]
    00d0 - 3f ff 52 7a 03 a7 ee f3-7f d0 f0 ae f2 b3 46 a0   ?.Rz..........F.

    Start Time: 1503072674
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
</code></pre></div>
<p dir="auto">(One difference I noticed was "Server Temp Key: DH, 1024 bits")<br>
The reason I included the outputs of both versions of <code class="notranslate">openssl</code> is because the version Python is using always seems to return 21, even when <code class="notranslate">-CAfile</code> is specified.<br>
I tried compiling Python with the other version of OpenSSL, but ran into issues, so I figured I should ask if that has a good chance of fixing my problem before continuing.</p>
<h2 dir="auto">Expected Result</h2>
<p dir="auto">A GET request should be made and retrieve some data. This does work with <code class="notranslate">verify=False</code>.</p>
<h2 dir="auto">Actual Result</h2>
<p dir="auto">Request seems to fail verifying the certificate.</p>
<h2 dir="auto">System Information</h2>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ python -m requests.help"><pre class="notranslate"><code class="notranslate">$ python -m requests.help
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{
  &quot;chardet&quot;: {
    &quot;version&quot;: &quot;3.0.4&quot;
  }, 
  &quot;cryptography&quot;: {
    &quot;version&quot;: &quot;2.0.3&quot;
  }, 
  &quot;implementation&quot;: {
    &quot;name&quot;: &quot;CPython&quot;, 
    &quot;version&quot;: &quot;2.7.12&quot;
  }, 
  &quot;platform&quot;: {
    &quot;release&quot;: &quot;2.6.32-642.11.1.el6.x86_64&quot;, 
    &quot;system&quot;: &quot;Linux&quot;
  }, 
  &quot;pyOpenSSL&quot;: {
    &quot;openssl_version&quot;: &quot;1010006f&quot;, 
    &quot;version&quot;: &quot;17.2.0&quot;
  }, 
  &quot;requests&quot;: {
    &quot;version&quot;: &quot;2.18.1&quot;
  }, 
  &quot;system_ssl&quot;: {
    &quot;version&quot;: &quot;1000105f&quot;
  }, 
  &quot;urllib3&quot;: {
    &quot;version&quot;: &quot;1.21.1&quot;
  }, 
  &quot;using_pyopenssl&quot;: true
}"><pre class="notranslate"><code class="notranslate">{
  "chardet": {
    "version": "3.0.4"
  }, 
  "cryptography": {
    "version": "2.0.3"
  }, 
  "implementation": {
    "name": "CPython", 
    "version": "2.7.12"
  }, 
  "platform": {
    "release": "2.6.32-642.11.1.el6.x86_64", 
    "system": "Linux"
  }, 
  "pyOpenSSL": {
    "openssl_version": "1010006f", 
    "version": "17.2.0"
  }, 
  "requests": {
    "version": "2.18.1"
  }, 
  "system_ssl": {
    "version": "1000105f"
  }, 
  "urllib3": {
    "version": "1.21.1"
  }, 
  "using_pyopenssl": true
}
</code></pre></div>