如何实现Python Requests与GoLang TLSv1 HTTPS服务器的连接测试

AI 小北

2026-6-23

问题

我有一台老旧的Windows 2003服务器，需测试TLSv1连接。我编写了GoLang HTTPS服务器代码并配置为仅使用TLSv1，同时在Windows 11机器上用Python3的requests模块编写了客户端，但连接时出现tls internal error。以下是相关代码与错误信息，请问如何解决该问题以实现TLSv1连接？

GoLang服务器代码

package main

import (
    "crypto/tls"
    "fmt"
    "log"
    "net/http"
    "runtime"
)

func main() {

    fmt.Printf("Hello %s/%s\n", runtime.GOOS, runtime.GOARCH)

    mux := http.NewServeMux()
    mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
        w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
        w.Write([]byte("This is an example server.\n"))
    })
    cfg := &tls.Config{
        MinVersion: tls.VersionTLS10,
        MaxVersion: tls.VersionTLS10,
    }
    srv := &http.Server{
        Addr:         ":443",
        Handler:      mux,
        TLSConfig:    cfg,
        TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 0),
    }
    log.Fatal(srv.ListenAndServeTLS("server.crt", "server.key"))
}

Python3客户端代码

from requests_toolbelt import SSLAdapter
import requests
import ssl

s = requests.Session()
p = ssl.PROTOCOL_TLSv1
s.mount('https://', SSLAdapter(p))
r = s.get('https://10.2.2.14/', verify=False)

Python3客户端错误输出

Traceback (most recent call last):
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\connectionpool.py", line 703, in urlopen
    httplib_response = self._make_request(
                       ^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\connectionpool.py", line 386, in _make_request
    self._validate_conn(conn)
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\connectionpool.py", line 1042, in _validate_conn
    conn.connect()
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\connection.py", line 414, in connect
    self.sock = ssl_wrap_socket(
                ^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\util\ssl_.py", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\util\ssl_.py", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\ssl.py", line 1075, in _create
    self.do_handshake()
  File "C:<>\Programs\Python\Python311\Lib\ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL] internal error (_ssl.c:1002)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:<>\Programs\Python\Python311\Lib\site-packages\requests\adapters.py", line 489, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\connectionpool.py", line 787, in urlopen
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\urllib3\util\retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='10.2.2.14', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL] internal error (_ssl.c:1002)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:tls_1.0_test_server\test-tls-connect.py", line 24, in <module>
    r = s.get('https://10.2.2.14/', verify=False)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 600, in get
    return self.request("GET", url, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 587, in request
    resp = self.send(prep, **send_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 701, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:<>\Programs\Python\Python311\Lib\site-packages\requests\adapters.py", line 563, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='10.2.2.14', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL] internal error (_ssl.c:1002)')))

解决方案

修复Go服务器的TLS配置：仅指定TLS版本不够，TLSv1需要搭配兼容的密码套件。Go默认的密码套件可能不包含TLSv1支持的老旧套件，需显式添加。修改后的TLS配置如下：
```
cfg := &tls.Config{
    MinVersion: tls.VersionTLS10,
    MaxVersion: tls.VersionTLS10,
    CipherSuites: []uint16{
        tls.TLS_RSA_WITH_AES_128_CBC_SHA,
        tls.TLS_RSA_WITH_AES_256_CBC_SHA,
        tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
    },
}
```
这些是TLSv1.0常用的兼容密码套件，确保能和Windows 2003的客户端匹配。

调整Python客户端的SSL配置：Python 3.11及以上版本默认可能禁用了TLSv1.0，需显式创建SSL上下文并启用允许的协议和套件。替换原客户端代码为：

import requests
import ssl
from requests.adapters import HTTPAdapter
from urllib3.poolmanager import PoolManager

class TLS1Adapter(HTTPAdapter):
    def init_poolmanager(self, connections, maxsize, block=False):
        ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
        ctx.set_ciphers('DEFAULT@SECLEVEL=1')
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        self.poolmanager = PoolManager(
            num_pools=connections,
            maxsize=maxsize,
            block=block,
            ssl_version=ssl.PROTOCOL_TLSv1,
            ssl_context=ctx
        )

s = requests.Session()
s.mount('https://', TLS1Adapter())
r = s.get('https://10.2.2.14/', verify=False)
print(r.text)

通过自定义适配器，设置SSL上下文的安全级别为1（允许老旧套件），同时明确指定TLSv1协议，规避默认配置的限制。

检查Windows 11的系统TLS设置：Windows 11默认可能禁用了TLSv1.0，需手动开启：
1. 打开「控制面板」→「Internet选项」→「高级」标签
2. 在「安全」区域勾选「使用TLS 1.0」
3. 点击「确定」后重启系统
验证证书兼容性：确保使用的server.crt和server.key是TLSv1兼容的，避免使用过于新的签名算法（如SHA-256以上可能不被老旧TLS支持，建议使用SHA-1签名的证书测试）。可通过以下命令生成兼容的自签名证书：
```
openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -sha1 -nodes
```

内容的提问来源于stack exchange，提问作者PhilBot

如何实现Python Requests与GoLang TLSv1 HTTPS服务器的连接测试

GoLang服务器代码 #

Python3客户端代码 #

Python3客户端错误输出 #

GoLang服务器代码

Python3客户端代码

Python3客户端错误输出