Repository navigation
How to force Client to use a specific TLS version? #469
Description
So basically im migrating from requests to httpx and i see i was forcing tlsv1_2 with requests HTTPadapter , but i dont think these is comp with httpx, i was wondering how i can force httpx to use specific tls version
from requests.adapters import HTTPAdapter
from urllib3.poolmanager import PoolManager
import ssl
class MyAdapter(HTTPAdapter):
def init_poolmanager(self, connections, maxsize, block=False):
self.poolmanager = PoolManager(num_pools=connections,
maxsize=maxsize,
block=block,
ssl_version=ssl.PROTOCOL_TLSv1_2)
....
session = requests.session()
session.mount('https://', MyAdapter())
I was doing like these in requests
Activity
florimondmanca commentedon Oct 10, 2019
Thanks for opening. Since I believe TLS v1.2 is considered insecure, I suppose you were forcing 1.2 because the client you’re connecting to is exposing that version of TLS? If you don’t have such a requirement anymore I’d advocate in favor of using 1.3.
If you really need it though, there may be an undocumented API (most likely SSLConfig) that you could somehow override, but I can’t dig it out right now.
qwerty32123 commentedon Oct 10, 2019
I need to force 1.2 for now, i have no choice cause the app im developing requires it, im sniffing http calls and copying them basically and they are made with tls 1.2
How i could force it then? i would have to edit httpx files? Thanks for answer @florimondmanca
sethmlarson commentedon Oct 10, 2019
TLSv1.2 is totally secure and recommended, we enforce TLSv1.2+ for all of our connections by default.
@GnubiBORED Are you trying to enforce exactly TLSv1.2 (meaning explicitly excluding TLSv1.3?)
[-]Force Client to use Specific Tls version?[/-][+]How to force Client to use a specific TLS version?[/+]qwerty32123 commentedon Oct 10, 2019
Yes, i need to in all my http calls just use TLSv1.2 never 1.3 atleast from now, cause the android app im sniffing uses 1.2 and i want to make the calls in the same way, with requests and httpadapter was easy to do. What im asking is if its possible to force specific tls version while making calls
sethmlarson commentedon Oct 10, 2019
So the way I'd recommend accomplishing this:
Currently we don't allow passing an
SSLConfigobject toverify=(which maybe we should because this is painful)qwerty32123 commentedon Oct 10, 2019
@sethmlarson but i need to verify request with charlesproxy ssl certificate too, these will be a problem?
sethmlarson commentedon Oct 10, 2019
You can pass
verify=[path to cert]into the constructor of thehttpx.SSLConfig()and that should work.sethmlarson commentedon Oct 10, 2019
Either that or you can call
ssl_context.load_verify_locations([path to cert])on the SSLContext object. That'll also work.qwerty32123 commentedon Oct 10, 2019
Thanks for everything as always, i will close the issue
alie42 commentedon Dec 10, 2025