Determining the IP address of server with bad TLS cert.

Preliminary notes:

• Thanks for requests!
• I investigated quite a bit and couldn't find an obvious solution to the issue. Where I looked: documentation, stack overflow, general web search.

Scenario:

• HTTPS service available via a DNS name mapped to multiple IP addresses.
• Each such address is handled by a different server.
• Some of those servers configured with a bad/wrong TLS certificate.

The issue:

• Requests like requests.get('https://multiple.example.net/') will sometimes succeed TLS validation and other times fail. How to determine the IP address of the server with the bad TLS certificate?

Why?

• I would like to be able to tell the service provider that their server at IP address "so and so" is presenting a wrong certificate.

The "give me an IP address" solutions I found all assume the HTTP connection has been established and are mostly based in the idea of using streaming mode to get to the underlying socket, calling getpeername() from there.

Those do not work in this scenario given that an requests.exceptions.SSLError exception is properly raised and there's no response object to work with from that point on. Unless the exception holds a reference to the socket, but I couldn't find it there.

Questions:

• Other than monkey-patching approaches, is there any solution for this challenge I may be missing?
• If not, should/could requests.exceptions.SSLError include a reference to the socket that lead to the failure, pretty much like all other requests exceptions include a reference to the request and response objects?

Thanks in advance.

Start by reproducing the requests.get() scenario with a DNS name resolving to multiple HTTPS servers and a failing certificate. Investigate how requests.exceptions.SSLError is propagated compared with the streaming getpeername() approach; done requires a settled, supported way to identify the failing server or a documented conclusion that this is not exposed.