使用requests.post传输大文件时出现SSL解密失败/错误记录MAC问题

问题场景 #

使用Python的requests库POST音频文件到ngrok暴露公网地址的Flask服务，文件小于1MB时正常，传输25MB及更大文件时触发SSL解密错误，运行环境为AMD Ryzen 5 2500U CPU。

客户端请求代码 #

with open(file_name, "rb") as audio_file:
    ngrok_url = 'https://****-***-***-*-**.ngrok-free.app/transcribe'
    response = requests.post(ngrok_url, data = audio_file, stream=True)
    transcription = json.loads(response.text)

Flask服务端代码 #

@app.route('/transcribe', methods=["POST"])
def transribe_audio():
    with open('test_audio.mp3', 'wb') as f:
        for chunk in request.stream:
            f.write(chunk)
    model = whisper.load_model("base")
    result = model.transcribe('test_audio.mp3', word_timestamps=True)
    response = json.dumps(result)
    return response

错误日志 #

requests.exceptions.SSLError: HTTPSConnectionPool(host='****-***-***-*-**.ngrok-free.app',
port=443): Max retries exceeded with url: /transcribe (Caused by SSLError(SSLError(1, '[SSL:
DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:2633)')))
Traceback (most recent call last):
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/urllib3/connectionpool.py", line 703, in urlopen
    httplib_response = self._make_request(
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/urllib3/connectionpool.py", line 449, in _make_request
    six.raise_from(e, None)
  File "<string>", line 3, in raise_from
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/urllib3/connectionpool.py", line 444, in _make_request
    httplib_response = conn.getresponse()
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/http/client.py", line 1371, in getresponse
    response.begin()
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/http/client.py", line 319, in begin
    version, status, reason = self._read_status()
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/http/client.py", line 280, in _read_status
    line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/socket.py", line 704, in readinto
    return self._sock.recv_into(b)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/ssl.py", line 1241, in recv_into
    return self.read(nbytes, buffer)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/ssl.py", line 1099, in read
    return self._sslobj.read(len, buffer)
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:2633)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/adapters.py", line 489, in send
    resp = conn.urlopen(
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    retries = retries.increment(
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='0e45-175-101-4-11.ngrok-free.app', port=443): 
Max retries exceeded with url: /transcribe (Caused by SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] 
decryption failed or bad record mac (_ssl.c:2633)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/trsncrpt/myservice.py", line 162, in processWhisperOpenai
    response = requests.post(ngrok_url, data = audio_file, stream=True)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/api.py", line 115, in post
    return request("post", url, data=data, json=json, **kwargs)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/sessions.py", line 587, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/sessions.py", line 701, in send
    r = adapter.send(request, **kwargs)
  File "/home/user_dev/.pyenv/versions/3.9.7/lib/python3.9/site-packages/requests/adapters.py", line 563, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='****-***-***-*-**.ngrok-free.app', port=443): 
Max retries exceeded with url: /transcribe (Caused by SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] 
decryption failed or bad record mac (_ssl.c:2633)')))

解决方案 #

1. 改用multipart/form-data传输大文件 #

直接传输raw data在大文件场景下容易触发SSL连接问题，改用标准文件上传格式：

客户端修改后代码

import requests
import json

with open(file_name, "rb") as audio_file:
    ngrok_url = 'https://****-***-***-*-**.ngrok-free.app/transcribe'
    # 以multipart形式上传文件
    files = {'audio': audio_file}
    # 设置足够长的超时时间，避免大文件传输超时
    response = requests.post(ngrok_url, files=files, timeout=300)
    transcription = json.loads(response.text)

服务端修改后代码

from flask import Flask, request
import whisper
import json

app = Flask(__name__)

# 提前加载Whisper模型，避免每次请求重复加载（减少处理时间）
model = whisper.load_model("base")

@app.route('/transcribe', methods=["POST"])
def transribe_audio():
    # 检查是否有文件上传
    if 'audio' not in request.files:
        return json.dumps({"error": "未提供音频文件"}), 400
    
    audio_file = request.files['audio']
    with open('test_audio.mp3', 'wb') as f:
        f.write(audio_file.read())
    
    result = model.transcribe('test_audio.mp3', word_timestamps=True)
    return json.dumps(result)

if __name__ == '__main__':
    # 调整Flask允许的最大请求大小，默认16MB，这里设为50MB
    app.config['MAX_CONTENT_LENGTH'] = 50 * 1024 * 1024
    app.run()

2. 升级依赖库版本 #

旧版本的requests、urllib3可能存在SSL相关bug，执行以下命令更新：

pip install --upgrade requests urllib3

3. 检查ngrok限制 #

ngrok免费版存在每月1GB带宽限制、单连接时长限制，大文件传输可能触发这些限制导致连接中断。可以：

• 测试时直接用本地IP访问Flask服务，排除ngrok的影响
• 若确为ngrok限制，考虑升级付费版

4. 临时排查方案（不推荐生产） #

若怀疑是SSL证书验证问题，可临时关闭验证（降低安全性，仅用于测试）：

response = requests.post(ngrok_url, files=files, timeout=300, verify=False)

内容的提问来源于stack exchange，提问作者saurabh dhyani