Deployer 0.7.1 on trusty cannot talk to Juju2 because :tlsv1 alert protocol version

[Curtis Hovey]

As seen in
    http://reports.vapour.ws/releases/issue/572365e1749a562e4e58d451

Deployer cannot talk to Juju2 (on maas2) because :tlsv1 alert protocol version

This issue relates to bug 1443704 in Ubuntu trusty. trusty's py 3.4 does support PROTOCOL_TLSv1_2.

[Nate Finch (natefinch)]

This is almost certainly because this is running on trusty, which uses python 2.7.6, and thus doesn't have TLS 1.2, as noted here: https://bugs.launchpad.net/ubuntu/+source/python2.7/+bug/1443704

[Nate Finch (natefinch)]

This is going to be handled by Marco Ceppi and Tim Vansteenburgh by porting deployer to python 3.

[Tim Van Steenburgh (tvansteenburgh)]

python 3 support for deployer is up for review, but I think I need to make a small change to python-jujuclient as well. Do I assume correctly that we should use TLSv1.2 for juju2, but continue to use TLSv1 for juju1?

[Tim Van Steenburgh (tvansteenburgh)]

On second thought, I guess python-jujuclient should always use TLSv1.2 now, for juju1 and juju2, right? Which means python 2.7.9+ or 3.4+.

[Tim Van Steenburgh (tvansteenburgh)]

The linked python-jujuclient branch changes jujuclient to always use TLSv1.2 if it's available. If it's not available, attempt to use TLSv1, but also issue a runtime warning about it, including a message that it may not actually work (Juju might not handshake). Someone that wants to connect to a version of Juju that doesn't support TLSv1.2 will need to use and older version of python-jujuclient.

[Marco Ceppi (marcoceppi)]

What's the first version of Juju which supports TLSv1.2?