Linkcheck shouldn't retry on SSL errors

[webknjaz]

Describe the bug

When linkcheck sees SSLError it still retries the HTTP request hoping for different results. It shouldn't do this and it's actually a great place for optimization.

(guides/supporting-windows-using-appveyor: line  152) broken    http://tox.testrun.org - HTTPSConnectionPool(host='tox.testrun.org', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError("hostname 'tox.testrun.org' doesn't match 'codespeak.net'")))

How to Reproduce

$ git clone https://github.com/pypa/packaging.python.org
$ cd packaging.python.org
$ pip install nox virtualenv -U
$ nox -s linkcheck
# After this, see the error cited above

Expected behavior

Linkcheck should mark links as broken, the first time it sees TLS errors related to fetching the respective URLs.
Moreover, linkcheck should memorize hostnames that produced have broken TLS configuration and skip checking any further links having the same domain — they'll result in the same issue so it's reasonable to mark them all broken right away saving resources and making the check fail fast.

Your project

https://github.com/pypa/packaging.python.org

Screenshots

No response

OS

GHA CI / Ubuntu 20.04

Python version

CPython v3.9.6

Sphinx version

v4.0.3

Sphinx extensions

sphinx.ext.extlinks, sphinx.ext.intersphinx, sphinx.ext.todo, sphinx_inline_tabs, sphinx_copybutton

Extra tools

No response

Additional context

https://github.com/pypa/packaging.python.org/pull/968/checks#step:7:116

[tk0miya]

Note: It seems the request library goes the retries.
https://stackoverflow.com/questions/23013220/max-retries-exceeded-with-url-in-requests

Moreover, linkcheck should memorize hostnames that produced have broken TLS configuration and skip checking any further links having the same domain

Understandable. But it's a bit difficult to share the list of broken TLS domains between threads and documents.

[jayaddison]

This has been partially addressed by #11431 since v7.1.0 - SSL failures on HTTP HEAD requests will not be followed by an attempt to make an HTTP GET to the same host.

There isn't yet any memory of TLS failures on a per-host basis though.