Spurious WinHttpSyncHttpClient error (Failed setting secure crypto protocols) on windows

[h-vetinari]

Describe the bug

When building pyarrow against aws-sdk-cpp 1.9.375, we get a spurious error when importing unrelated code, and on non-AWS hardware:

import: 'pyarrow.parquet'
[FATAL] 2022-11-08 00:12:43.210 WinHttpSyncHttpClient [2936] Failed setting secure crypto protocols with error code: 87

Based on the various issues on this tracker I think the error is coming from here.

Note that this only occurs on windows!

The only recent change around the code in question was 10ac040, and I don't see how this should affect behaviour.

PS. we have been blocked for a very long time from moving to 1.9 by #1809, I'm now trying to test if the recent changes have fixed things.

Expected Behavior

No error, especially if not running on non-AWS hardware.

Note that pyarrow is a library, so we want it to have support for AWS by default, but it will run in many environments that are not related to AWS, and those users should not be spammed with spurious warnings.

Current Behavior

import: 'pyarrow.parquet'
[FATAL] 2022-11-08 00:12:43.210 WinHttpSyncHttpClient [2936] Failed setting secure crypto protocols with error code: 87

Reproduction Steps

Build pyarrow against aws-sdk-cpp, then import pyarrow.parquet. Happy to assist (or provide ways to install the affected artefacts).

Possible Solution

?

Additional Information/Context

Note that we unbundle the various c-libs from the sdk in conda-forge (e.g. if packages only need certain libraries, it avoids a lot of duplication, and we don't have to rebuild packages that only depend on the SDK ABI all the time). Since the libraries changes are potentially ABI-sensitive, we rebuild the stack as necessary once new versions come along. In this case, the used versions are:

    aws-c-auth:         0.6.18-hc619888_9           conda-forge
    aws-c-cal:          0.5.20-h1508bda_2           conda-forge
    aws-c-common:       0.8.4-hcfcfb64_0            conda-forge
    aws-c-compression:  0.2.15-h65f5089_4           conda-forge
    aws-c-event-stream: 0.2.15-h19423c0_5           conda-forge
    aws-c-http:         0.6.24-h4009455_0           conda-forge
    aws-c-io:           0.13.6-h1d9865d_1           conda-forge
    aws-c-mqtt:         0.7.12-h0ebae2a_14          conda-forge
    aws-c-s3:           0.1.51-hcc69c5e_5           conda-forge
    aws-c-sdkutils:     0.1.6-h65f5089_0            conda-forge
    aws-checksums:      0.1.13-h65f5089_4           conda-forge
    aws-crt-cpp:        0.18.9-hd073640_8           conda-forge
    aws-sdk-cpp:        1.9.375-haf9a486_1          conda-forge

AWS CPP SDK version used

1.9.375

Compiler and Version used

VS2019

Operating System and version

windows

[jmklix]

Thanks for taking the time to try to get pyarrow working with the aws-sdk-cpp.

Can you include the cmake commands that you are using to build? Also what version of windows are you using?

[h-vetinari]

Hey @jmklix, thanks for the quick response. The build script is here, and everything is running in windows-2019 images within azure pipelines.

[abianco88]

Is there a way to solve this problem on an AWS Windows machine with PyArrow v11.0.0?

[abianco88]

Are there any updates on this issue? I experience the same issue on a Win machine on AWS with aws-sdk-cpp v1.10.57.

[vindevoy]

I have the same problem on a Windows server that has never even heard of AWS.

[jmklix]

If you are running into this issue can you let us know what version of winhttp client you are using? It's possible that this was built with tls 1.2 and 1.3 available, but when you are trying to use this you don't have the same version on your machine

[github-actions]

Greetings! It looks like this issue hasn’t been active in longer than a week. We encourage you to check if this is still an issue in the latest release. Because it has been longer than a week since the last update on this, and in the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or add an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one.