Ubuntu
openssl package

  1. Bug #1899878
  2. Comment #5

Comment 5 for bug 1899878

Revision history for this message
Christian Heimes (heimes) wrote :

This is really just a problem with Ubuntu 20.04 and 20.10 (and maybe older/newer releases). The same tests are passing fine on latest Debian testing as well as Fedora. Debian testing and Fedora use a crypto policy that raises security level to 2 and disallows TLS 1.0 and 1.1. Python's test suite introspects OpenSSL settings and skips tests of disabled TLS versions.

There seems to be a major difference between Debian and Ubuntu's downstream patches of OpenSSL. Ubuntu's patch causes two problems

1) Python cannot figure out that TLS 1.0 and 1.1 are disabled on Ubuntu. The same code works fine on Debian and Fedora.
2) With some configuration, OpenSSL's SSL_do_handshake() function fails with an "internal error" message (SSL_AD_INTERNAL_ERROR / TLS1_AD_INTERNAL_ERROR) somewhere in its internal state machine.

I suggest that you involve Kurt and look at the difference between Debian's downstream patch and Ubuntu's downstream patch.