Indeed ssl.create_default_context() can be used again (as it's purpose) after initializing it:

import ssl, smtplib
>>> smtp = smtplib.SMTP("mail.python.org", port=587)
>>> context = ssl.create_default_context()
>>> smtp.starttls(context=context)

(220, b'2.0.0 Ready to start TLS')

↳ https://docs.python.org/3/library/ssl.html#best-defaults

Any data transmitted over HTTP is plain text and might be intercepted or read by anyone who has control of the devices/networks between the client and the server. HTTP should no longer be used for transmitting sensitive information.

Any request over HTTPS is today normally secure when using modern software and standard configuration. A modern server would refuse insecure connections, and a modern client would also refuse insecure connections.

However, a badly configured client (like older versions of Python) that don't do HTTPS certificate validation can lead to security problems. If anyone has full control over the network connection between your client and the server they might be intercepting and reading everything that is being transmitted. This is why you read that ssl.create_default_context() is recommended since it would configure older versions of Python to do certificate validation and set a recommended set of ciphers.

Not validating a certificate doesn't necessarily mean that your data is unsafe. If your connection ended up in the intended destination at the web server you wanted to reach, the connection is still securely encrypted (unless both the client and the server allows insecure protocols/ciphers). Even if someone like your ISP would try to dump the transmitted data, it would not be readable.

However, without validating the certificate you are vulnerable to man in the middle attacks if anyone in the network between your client and the web server is able to intercept your connection or by other means redirect your connection to a rogue server which can read the contents of your request (including any passwords), and pass it on to the real destination so you won't notice any thing.

1. If you are using an older version of Python that does not validate SSL certificates by default, and you ALSO have a reason to not trust your ISP or any network between your client and the server, you should be worried. If you are using a newer version of Python it is secure and there is no need to worry. If you are using an older version that does not validate certificates by default, but you do trust the path between your client and the server, it should probably be OK was well.

2. If you were using an old version of Python that does not validate SSL certificates by default, ssl.create_default_context() should be enough to validate certificates and enable a decent set of protocols and ciphers. Using a newer version of Python will automatically validate SSL certificates.

From release version 2.7.9/3.4.3, Python will validate certificates by default. This affects all relevant stdlib modules (urllib/urllib2, http, httplib).

Sources and documentation: https://www.python.org/dev/peps/pep-0476/ https://docs.python.org/2/library/httplib.html#httplib.HTTPSConnection

A self-signed certificate is a trick to pretend that the CA is the certificate itself. So we have to provide beforehand the client with this certificate in order to trust it when it will be encountered.

In the client, after the creation of the SSL context, I tried something similar to

context.load_verify_locations('/home/hfurmans/ssl-cert-snakeoil.pem')

and it worked.
( https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_verify_locations)

I only had to remove context.verify_mode = ssl.CERT_REQUIRED in the server because I didn't provide my client with its own certificate, but that was not the problem reported in your question.

Of course, for all of this to work, your certificate must have the correct common-name.
If the client connects to myipaddress (as a hostname), then the common-name of the certificate must be myipaddress too.

In order to make the requests library use a custom ssl context, you need to create a custom HTTPAdapter class and override the init_poolmanager method to pass in extra arguments to the base class's implementation.

See sample code here:

from requests import Session
from requests.adapters import HTTPAdapter
import ssl


class CustomHTTPAdapter(HTTPAdapter):

    def init_poolmanager(self, *args, **kwargs):
        # this creates a default context with secure default settings,
        # which enables server certficiate verification using the
        # system's default CA certificates
        context = ssl.create_default_context()

        # alternatively, you could create your own context manually
        # but this does NOT enable server certificate verification
        # context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)

        super().init_poolmanager(*args, **kwargs, ssl_context=context)


def main():
    client_session = Session()
    client_session.mount("https://", CustomHTTPAdapter())

    # now you can use the client_session to make requests
    # r = client_session.get("https://<web address>/rest/info?f=json")