InsecurePlatformWarning

[seanthewebber]

./letsencrypt-auto is generating an InsecurePlatformWarning on Ubuntu 14.04 LTS. This looks like a conflict between python and python3? What is the proper way to resolve this conflict and how can we implement a fix to eliminate a custom workaround?

Terminal excerpt:

swebber@dev:~/letsencrypt$ sudo -H ./letsencrypt-auto --help
...
Updating letsencrypt and virtual environment dependencies.....
/home/swebber/.local/share/letsencrypt/local/lib/python2.7/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
/home/swebber/.local/share/letsencrypt/local/lib/python2.7/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning

[devster31]

It should only be an issue because ubuntu ships with python 2.7.6 while urllib issues that warning on anything below 2.7.9, updating python2 should fix it.

Certain Python platforms (specifically, versions of Python earlier than 2.7.9)
from https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning

[seanthewebber]

That's strange. I just ran sudo apt-get update and sudo apt-get dist-upgrade on this server and everything (including python?) is up to date.

[devster31]

Ubuntu repos have an older version, try running python --version, if it's below 2.7.9 you get the error you described.

[seanthewebber]

swebber@dev:~$ python --version
Python 2.7.6

Yep, there it is. Does that mean these instructions will over write the older version assuming you replaced 2.7.5 with 2.7.10?

[devster31]

It should. You probably need to run those instructions as root, you can also check the official python docs here. Latest stable is 2.7.11 for python2. You can also use this PPA if you don't want to build from source.

[seanthewebber]

So you either run unofficial or update by building the source... that's a pain. Is there any reason python3 cannot be added to letsencrypt-auto:90 like this:

DeterminePythonVersion() {
  if command -v python3.4 > /dev/null ; then
    export LE_PYTHON=${LE_PYTHON:-python3.4}
  elif command -v python3 > /dev/null ; then
    export LE_PYTHON=${LE_PYTHON:-python3}
...
}

[seanthewebber]

I suppose an if statement detecting Python < 2.7.9 and implementing pyOpenSSL is also an option, but it seems like a dirty patch that could break break more than it solves.

[devster31]

It shouldn't be a python2 and python3 conflict since letsencrypt-auto generates a virtual environment based on the python2 version your system has. You could could add it to a requirements file for versions below 2.7.9 here. I can't answer you on the python3 support however.

[seanthewebber]

What would the syntax for that look like? Additionally, that would require urllib3.contrib.pyopenssl.inject_into_urllib3() to be copied throughout the code base?

[seanthewebber]

@devster31 @pde I was poking around the other open issues and it looks like this may be a duplicate of #1623? Thoughts or comments?

[devster31]

I think it's a duplicate if you only get the warning during the initial run, if I understood correctly I don't think there's a way to avoid that besides suppressing warnings as suggested in #1623. However further warnings during normal letsencrypt operations should be fixed separately using something like what's already in acme/acme/client.py:

# Prior to Python 2.7.9 the stdlib SSL module did not allow a user to configure
# many important security related options. On these platforms we use PyOpenSSL
# for SSL, which does allow these options to be configured.
# https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
if sys.version_info < (2, 7, 9):  # pragma: no cover
    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()

which would be the best solution possible. PyOpenSSL is already a dependency and is installed during the bootstrap process, so the fix would be to add the above lines wherever requests is imported.

[seanthewebber]

Mm.. who could do something like that? Admittedly, I know not how to write Python. :/

Would suppressing the warning still allow certificates to be deployed, or would more runtime errors occur later on down the road? I'm writing a tutorial about Let's Encrypt and I'm on the fence about telling readers to suppress warnings. :/