Boto在ssl.c中不断崩溃

Question

每大约三次连接尝试，boto就会崩溃一次，导致我们无法打开连接。

在它离开Python之前，我打印了所有的参数，每次连接的参数都是一样的。

以下是错误堆栈信息：

boto/sqs/connection.pyc in get_queue(self, queue_name)
    292         :returns: The requested queue, or ``None`` if no match was found.
    293         """
--> 294         rs = self.get_all_queues(queue_name)
    295         for q in rs:
    296             if q.url.endswith(queue_name):

boto/sqs/connection.pyc in get_all_queues(self, prefix)
    281         if prefix:
    282             params['QueueNamePrefix'] = prefix
--> 283         return self.get_list('ListQueues', params, [('QueueUrl', Queue)])
    284 
    285     def get_queue(self, queue_name):

boto/connection.pyc in get_list(self, action, params, markers, path, parent, verb)
    880         if not parent:
    881             parent = self
--> 882         response = self.make_request(action, params, path, verb)
    883         body = response.read()
    884         boto.log.debug(body)

boto/connection.pyc in make_request(self, action, params, path, verb)
    866         if self.APIVersion:
    867             http_request.params['Version'] = self.APIVersion
--> 868         return self._mexe(http_request)
    869 
    870     def build_list_params(self, params, items, label):

boto/connection.pyc in _mexe(self, request, sender, override_num_retries, retry_handler)
    792             raise BotoServerError(response.status, response.reason, body)
    793         elif e:
--> 794             raise e
    795         else:
    796             msg = 'Please report this exception as a Boto Issue!'

SSLError: _ssl.c:316: Invalid SSL protocol variant specified.

这里是相关的C语言代码：

PySSL_BEGIN_ALLOW_THREADS
if (proto_version == PY_SSL_VERSION_TLS1)
    self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */
else if (proto_version == PY_SSL_VERSION_SSL3)
    self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */
else if (proto_version == PY_SSL_VERSION_SSL2)
    self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */
else if (proto_version == PY_SSL_VERSION_SSL23)
    self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
PySSL_END_ALLOW_THREADS

if (self->ctx == NULL) {
    errstr = ERRSTR("Invalid SSL protocol variant specified.");
    goto fail;
}

我们打印了proto_version，它总是显示PY_SSL_VERSION_SSL23，我觉得SSL_CTX_new可能因为某种原因失败了。

有没有人知道可能出什么问题了？

Answer 1

最新版本的certifi有一些问题，所以降级到旧版本的certifi可以解决这个问题。

pip uninstall -y certifi && pip install certifi==2015.04.28

                            or 

pip install requests[security]

Answer 2

结果发现是我们加载的一个证书可能有问题，奇怪的是它并不是每次都会导致崩溃。

总之，删除这个证书就解决了问题。