pypi.org: HTTP access no longer an option

[Wilfred]

It used to be the case that http://pypi.python.org/simple was accessible without HTTPS. This was important in legacy environments that don't support the certificates offered:

curl -L http://pypi.python.org/simple
curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version

pip has a --trusted-host option to support this use case, and has the appropriate caveats in the docs.

This doesn't seem to be accessible any more for pypi.org. Could this please be restored?

[brainwane]

Hi, @Wilfred -- can you talk about why the legacy environments in question can't upgrade their TLS support versions? Thanks.

[ewdurbin]

Based on the error, you are receiving a redirect from HTTP to HTTPS. This has been the behavior from pypi.python.org for as long as I can remember.

$ curl -I http://pypi.python.org/simple/
HTTP/1.1 301 Moved Permanently
Server: Varnish
Retry-After: 0
Location: https://pypi.org/simple/
...

The root of the issue you have opened is that your client is unable to negotiate a TLSv1.2 connection to PyPI. Until April 10th, 2018 this would have succeeded.

PyPI is no longer accessible to clients which do not support TLSv1.2 due to our CDN provider sunsetting support. We cannot reenable access for outdated TLS protocols.

If you provide more information on your environment someone may be able to assist you in upgrading to support modern TLS protocols.

[Wilfred]

@ewdurbin it was previously possible to access /simple without HTTPS as recently as January 2018. I have in my bash logs:

18-10-17 17:57  pip install --trusted-host pypi.python.org -i http://pypi.python.org/simple --upgrade $pkg

[ewdurbin]

@Wilfred You were not communicating with the index over HTTP, in the request log you have supplied above, pip would have received a HTTP 301 with Location: https://pypi.python.org/simple and proceeded to follow the redirect into HTTPS.

The root issue here is that your client does not support TLSv1.2, and PyPI only supports TLSv1.2 or higher.

Again. If you are able to provide more information about your environment (OS version, TLS implementation and version, Python version, pip version) someone may be able to help you.