[Python] python can't connect, but openssl can

I am trying to connect to a legacy (windows server 2008R2) server using python / winrm. I am seeing an issue where openssl can establish the ssl socket cleanly, but python and winrm can't. I am using python3.12 on ubuntu 24.04 (noble)

here is the python code:

import ssl, socket
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
ctx.verify_mode = ssl.CERT_NONE
with socket.create_connection(('server.example.com', 5986)) as sock:
ssock = ctx.wrap_socket(sock)
print(ssock.cipher(), ssock.version())


this code fails with the following error:

SSLEOFError: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1010)

and here is the output from openssl s_client -connect:

CONNECTED(00000003)
depth=0 CN = server.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = server.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:CN = server.example.com
i:CN = server.example.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFADCC....
-----END CERTIFICATE-----
subject=CN = server.example.com

issuer=CN = server.example.com

---
No client certificate CA names sent
Peer signing digest: SHA1
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2084 bytes and written 505 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: E223.....
Session-ID-ctx:
Master-Key: 83FBC.....
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1751134634
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: yes
---


they both see the unexpected EOF, but it looks like python can't handle the unexpected EOF gracefully while openssl can. Is there anything I can do to establish the ssl connection in python like I can with openssl or curl?

Continue reading...