From 0a6d8e3c6325da395a04227599cfa292190d6841 Mon Sep 17 00:00:00 2001
From: Nate Prewitt <nate.prewitt@gmail.com>
Date: Thu, 27 Apr 2023 11:08:03 -0600
Subject: [PATCH] Defer to system defaults for cipher suites with urllib3 2.0+
 (#2922)

---
 botocore/httpsession.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Index: awscli/awscli/botocore/httpsession.py
===================================================================
--- awscli.orig/awscli/botocore/httpsession.py
+++ awscli/awscli/botocore/httpsession.py
@@ -19,7 +19,6 @@ from urllib3.exceptions import ReadTimeo
 from urllib3.exceptions import SSLError as URLLib3SSLError
 from urllib3.util.retry import Retry
 from urllib3.util.ssl_ import (
-    DEFAULT_CIPHERS,
     OP_NO_COMPRESSION,
     PROTOCOL_TLS,
     OP_NO_SSLv2,
@@ -42,6 +41,14 @@ try:
 except ImportError:
     from urllib3.util.ssl_ import SSLContext
 
+try:
+    from urllib3.util.ssl_ import DEFAULT_CIPHERS
+except ImportError:
+    # Defer to system configuration starting with
+    # urllib3 2.0. This will choose the ciphers provided by
+    # Openssl 1.1.1+ or secure system defaults.
+    DEFAULT_CIPHERS = None
+
 import botocore.awsrequest
 from botocore.compat import (
     IPV6_ADDRZ_RE,
@@ -99,7 +106,10 @@ def create_urllib3_context(
 
     context = SSLContext(ssl_version)
 
-    context.set_ciphers(ciphers or DEFAULT_CIPHERS)
+    if ciphers:
+        context.set_ciphers(ciphers)
+    elif DEFAULT_CIPHERS:
+        context.set_ciphers(DEFAULT_CIPHERS)
 
     # Setting the default here, as we may have no ssl module on import
     cert_reqs = ssl.CERT_REQUIRED if cert_reqs is None else cert_reqs
