[2.7] test_ssl: test_protocol_sslv23() and test_protocol_tlsv1_1() fail on RHEL8

[vstinner]

BPO	38338
Nosy	@vstinner, @tiran, @stratakis, @miss-islington
PRs	bpo-38338, test.pythoninfo: add more ssl infos #16539 [3.8] bpo-38338, test.pythoninfo: add more ssl infos (GH-16539) #16541 [3.7] bpo-38338, test.pythoninfo: add more ssl infos (GH-16539) #16542 [2.7] bpo-38338, test.pythoninfo: add more ssl infos #16543

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2020-02-07.10:55:20.086>
created_at = <Date 2019-10-01.12:55:54.221>
labels = ['expert-SSL', 'tests']
title = '[2.7] test_ssl: test_protocol_sslv23() and test_protocol_tlsv1_1() fail on RHEL8'
updated_at = <Date 2020-02-07.10:55:20.086>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2020-02-07.10:55:20.086>
actor = 'vstinner'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2020-02-07.10:55:20.086>
closer = 'vstinner'
components = ['Tests', 'SSL']
creation = <Date 2019-10-01.12:55:54.221>
creator = 'vstinner'
dependencies = []
files = []
hgrepos = []
issue_num = 38338
keywords = ['patch']
message_count = 7.0
messages = ['353691', '353742', '353744', '353747', '353751', '359637', '361578']
nosy_count = 4.0
nosy_names = ['vstinner', 'christian.heimes', 'cstratak', 'miss-islington']
pr_nums = ['16539', '16541', '16542', '16543']
priority = 'normal'
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue38338'
versions = ['Python 2.7']

[vstinner]

SSLv23 and TLS v1.0 are disabled by RHEL8 crypto policy.

AMD64 RHEL8 2.7:
https://buildbot.python.org/all/#/builders/245/builds/5

test_protocol_sslv23 (test.test_ssl.ThreadedTests)
Connecting to an SSLv23 server with various client options ...
Could not scan /etc/ssl/openssl.cnf for MinProtocol: [Errno 2] No such file or directory: '/etc/ssl/openssl.cnf'

PROTOCOL_TLS->PROTOCOL_TLS CERT_NONE
PROTOCOL_TLSv1->PROTOCOL_TLS CERT_NONE
ERROR

======================================================================
ERROR: test_protocol_sslv23 (test.test_ssl.ThreadedTests)
Connecting to an SSLv23 server with various client options
----------------------------------------------------------------------

Traceback (most recent call last):
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 189, in f
    return func(*args, **kwargs)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2402, in test_protocol_sslv23
    try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1')
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2134, in try_protocol_combo
    chatty=False, connectionchatty=False)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2062, in server_params_test
    s.connect((HOST, server.port))
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 864, in connect
    self._real_connect(addr, False)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 855, in _real_connect
    self.do_handshake()
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 828, in do_handshake
    self._sslobj.do_handshake()
SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:727)

and

test_protocol_tlsv1_1 (test.test_ssl.ThreadedTests)
Connecting to a TLSv1.1 server with various client options. ...
Could not scan /etc/ssl/openssl.cnf for MinProtocol: [Errno 2] No such file or directory: '/etc/ssl/openssl.cnf'

PROTOCOL_TLSv1_1->PROTOCOL_TLSv1_1 CERT_NONE
{PROTOCOL_TLS->PROTOCOL_TLSv1_1} CERT_NONE
PROTOCOL_TLSv1_1->PROTOCOL_TLS CERT_NONE
ERROR

======================================================================
ERROR: test_protocol_tlsv1_1 (test.test_ssl.ThreadedTests)
Connecting to a TLSv1.1 server with various client options.
----------------------------------------------------------------------

Traceback (most recent call last):
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 189, in f
    return func(*args, **kwargs)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2477, in test_protocol_tlsv1_1
    try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1_1, 'TLSv1.1')
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2134, in try_protocol_combo
    chatty=False, connectionchatty=False)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/test/test_ssl.py", line 2062, in server_params_test
    s.connect((HOST, server.port))
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 864, in connect
    self._real_connect(addr, False)
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 855, in _real_connect
    self.do_handshake()
  File "/home/buildbot/buildarea/2.7.cstratak-RHEL8-x86_64/build/Lib/ssl.py", line 828, in do_handshake
    self._sslobj.do_handshake()
SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:727)

[vstinner]

New changeset b3e7045 by Victor Stinner in branch 'master':
bpo-38338, test.pythoninfo: add more ssl infos (GH-16539)
b3e7045

[miss-islington]

New changeset ab98cd8 by Miss Islington (bot) in branch '3.7':
bpo-38338, test.pythoninfo: add more ssl infos (GH-16539)
ab98cd8

[vstinner]

New changeset 403ca7e by Victor Stinner in branch '2.7':
[2.7] bpo-38338, test.pythoninfo: add more ssl infos (GH-16543)
403ca7e

[miss-islington]

New changeset 183733d by Miss Islington (bot) in branch '3.8':
bpo-38338, test.pythoninfo: add more ssl infos (GH-16539)
183733d

[vstinner]

I marked bpo-39265 as a duplicate.

[vstinner]

Python 2.7 is no longer maintained, I close this issue.