SSL Shutdown error in 3.12.4

[colin-kerkhof]

Describe the bug

There is a ClientConnectionError in 3.12.4.

• It is not present in earlier versions of the aiohttp (It is not present in 3.12.2 or 3.12.3).
• I have tested with azure-storage-blob 12.25.* and 12.24.* and the error occurs in all versions I've tested.

The log is: "while closing connector: ClientConnectionError('Connection lost: SSL shutdown timed out')"

The error pops up at when using the async BlobClient from azure-storage-blob (azure.storage.blob.aio.BlobClient), but not when using the Sync client.

noteworthy:

• the endpoint is a streaming endpoint (returns a 206)
• The result is still yielded in the end, there is just a 30 second block while the endpoint is trying to close the connection.

To Reproduce

from azure.identity.aio import DefaultAzureCredential
from azure.storage.blob.aio import BlobClient

credential = DefaultAzureCredential()
async with BlobClient(
account_url=AZURE_STORAGE_ACCOUNT_NAME,
container_name=AZURE_STORAGE_CONTAINER_NAME,
blob_name=read_path,
credential=credential,
) as blob_client:
file_bytes = await blob_client.download_blob()
r = await file_bytes.readall()
r

Expected behavior

To return the result without a 30 second block.

Logs/tracebacks

while closing connector: ClientConnectionError('Connection lost: SSL shutdown timed out')

Python Version

$ python --version
3.13.2

aiohttp Version

$ python -m pip show aiohttp
Version: 3.12.4

multidict Version

$ python -m pip show multidict
Version: 6.4.3

propcache Version

$ python -m pip show propcache
Version: 0.3.1

yarl Version

$ python -m pip show yarl
Version: 1.20.0

OS

macOS, aarch64

Related component

Client

Additional context

No response

Code of Conduct

• I agree to follow the aio-libs Code of Conduct

[webknjaz]

This would benefit from an aiohttp-only reproducer.

[neonknight]

We encounter the same issue with opensearch-py and aiohttp 3.12.4 - a downgrade of aiohttp prevents the error.

[bdraco]

Thanks for the detailed report. What you're seeing is actually a result of finally fixing a long-standing issue in aiohttp: aio-libs/aiohttp#1925, which was causing resource leaks when the connector was closed.

In aiohttp 3.12.4, we addressed that by enforcing proper SSL shutdown behavior (PR #11074). Unfortunately, this can expose existing issues on some backends or usage patterns, like streaming responses from Azure Blob Storage, that were previously masked.

The delay you're experiencing (the 30 second block) happens because the SSL connection isn't shutting down cleanly and is hitting a timeout on close. It doesn't affect the data being returned, but it does delay the final cleanup.

We’d really prefer not to revert the fix and reintroduce the resource leak. Ideally, Azure's client or the server could handle SSL shutdown more gracefully, or aiohttp might need a more targeted workaround, such as an optional aggressive shutdown that bypasses SSL close.

If you can isolate a minimal repro, especially showing this delay on real endpoints, that would help us investigate whether a mitigation is feasible without reopening the original leak.

[PhilippPHoffmann]

I'm experiencing the same issue with the Azure Event Hub APIs.
I understand that the new behavior is intended, but this will cause a lot of problems if Microsoft doesn't close the SSL connections as it should.

[bdraco]

We completely understand that this can cause problems in real-world scenarios. To figure out the best path forward, whether that means raising the issue with Azure, making a change on our side, or exploring a workaround, we need a minimal reproducible example.

If you can share a small script or setup that reliably triggers the problem, it would really help. Without that, it's hard for us to investigate properly or decide what can be done without risking a return of the original connection leak.

Thanks again for bringing this to our attention. We appreciate your help in getting it resolved.

[webknjaz]

Asking the maintainers of those projects that misbehave might help, since those people would know better how to distill a reproducer from their side to have an aiohttp repro. The snippet above is for MS to look at, not for us, really. We can't troubleshoot arbitrary third-party projects.

[jabbera]

Repro:

import asyncio
import logging

from azure.data.tables.aio import TableServiceClient

logger = logging.getLogger(__name__)


async def create_table_with_async_table_service_client() -> None:
    logger.info("Creating table asynchronously...")
    async with TableServiceClient.from_connection_string("<connection_string>") as table_service_client:
        await table_service_client.create_table_if_not_exists("TestTable")
        logger.info("TestTable created successfully or already exists")
    logger.info("AsyncTableServiceClient exited successfully")


async def do_nothing_in_async_table_service_client() -> None:
    logger.info("Doing nothing in AsyncTableServiceClient...")
    async with AsyncTableServiceClient.from_connection_string("<connection_string>"):
        logger.info("AsyncTableServiceClient is ready for use - doing nothing")
    logger.info("AsyncTableServiceClient exited successfully")


async def main() -> None:
    logging.basicConfig(level=logging.INFO)

    await create_table_with_async_table_service_client()
    await do_nothing_in_async_table_service_client()


if __name__ == "__main__":
    asyncio.run(main())

Stolen from here: Azure/azure-sdk-for-python#41363 Maybe some folks from here can pile onto the azure issue.

[lmazuel]

Hello, manager of the Azure SDK for Python here. We spent time this afternoon on this, and were able to do a repro without SDK usage:

import asyncio
import aiohttp
import logging

logging.basicConfig(level=logging.DEBUG)
logging.getLogger("aiohttp").setLevel(logging.DEBUG)

async def main():
    url = "https://reproaiohttp.blob.core.windows.net/hello/world.txt"  # Example SSL streaming endpoint
    async with aiohttp.ClientSession() as session:
        async with session.get(url) as resp:
            print(f"Status: {resp.status}")
            print("Streaming response:")
            async for line in resp.content:
                print(line.decode().strip())


if __name__ == "__main__":
    asyncio.run(main())

It always end with:

DEBUG:asyncio:Using selector: EpollSelector
Status: 200
Streaming response:
ERROR:root:Error while closing connector: ClientConnectionError('Connection lost: SSL shutdown timed out')

The url is an anonymous storage link, no auth needed you can call it. We tested a variety of OS / Py version / corporate and personal network, and the results are consistent.

Given this repro is not using anything else than aiohttp, is it possible for you to help investigate what is wrong? I agree this can be Azure server doing something strange, anything you would discover would be helpful. We're also trying to continue to chunk this into smaller steps, someone in my team is trying basic SSL sockets right now, trying to understand what is happening where.

As a side note, it seems people have got issues with MS Graph as well with direct aiohttp (though their version doesnn't match, but it may be a report issue): https://learn.microsoft.com/en-us/answers/questions/2280086/aiohttp-clientconnectionerror-ssl-shutdown-timed-o?source=docs

[bdraco]

Thanks for sharing the repro. I ran the script but didn’t see the error right away. I'm trying to understand how long I should expect to wait for it to occur. Does it happen consistently after some time, or are there additional steps needed to trigger it?

Disregard, I was testing with a patched version