gh-146207: Add support for OpenSSL 4.0.0 alpha1 by vstinner · Pull Request #146217 · python/cpython

vstinner · 2026-03-20T15:53:31Z

OpenSSL 4.0.0 alpha1 no longer defines the symbols:

SSLv3_method
TLSv1_method
TLSv1_1_method
TLSv1_2_method

Issue: Building with OpenSSL-4.0.0-alpha1 fails with #146207

OpenSSL 4.0.0 alpha1 no longer defines the symbols: * SSLv3_method * TLSv1_method * TLSv1_1_method * TLSv1_2_method

vstinner · 2026-03-20T15:54:07Z

I didn't test my own change on OpenSSL 4.0.0 alpha1, I only asked @heitbaum to test my change.

zware · 2026-03-20T16:16:22Z

@vstinner This patch (should, probably :) ) be enough to get you a test in CI, even if we don't want to merge it yet:

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2fa2ab768dc..40feaef01ce 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -275,6 +275,7 @@ jobs:
           - { name: openssl, version: 3.4.4 }
           - { name: openssl, version: 3.5.5 }
           - { name: openssl, version: 3.6.1 }
+          - { name: openssl, version: 4.0.0-alpha1 }
           ## AWS-LC
           - { name: aws-lc, version: 1.68.0 }
     env:

vstinner · 2026-03-20T16:25:40Z

I applied @zware's patch: Tests / Ubuntu SSL tests (ubuntu-24.04, openssl, 4.0.0-alpha1) job is currently running.

@vstinner This patch (should, probably :) ) be enough to get you a test in CI, even if we don't want to merge it yet

Yeah, I will revert this patch once we get the openssl, 4.0.0-alpha1 CI job result.

zware · 2026-03-20T16:29:49Z

Not as simple as hoped :(. I can reproduce the CI failure locally, though; there's a missing symlink (or openssl is just looking in the wrong place) for lib -> lib64 in the openssl install directory.

With that, I get these failures:

2 tests failed:                   
    test_ssl test_urllib2_localnet
                                               
43 tests OK.
                                               
0:00:23 load avg: 3.07 Re-running 2 failed tests in verbose mode in subprocesses
0:00:23 load avg: 3.07 Run 2 tests in parallel using 2 worker processes
0:00:24 load avg: 3.07 [1/2/1] test_ssl failed (1 failure)
Re-running test_ssl in verbose mode (matching: test_openssl_version)
test_ssl: testing with 'OpenSSL 4.0.0-alpha1 10 Mar 2026' (4, 0, 0, 0, 0)
          under 'Linux-6.19.7-200.fc43.x86_64-x86_64-with-glibc2.42'                                                                                                                         
          HAS_SNI = True   
          OP_ALL = 0x80000050
          OP_NO_TLSv1_1 = 0x10000000
test_openssl_version (test.test_ssl.BasicSocketTests.test_openssl_version) ... FAIL
                                               
======================================================================
FAIL: test_openssl_version (test.test_ssl.BasicSocketTests.test_openssl_version)
----------------------------------------------------------------------
Traceback (most recent call last):                                                                                                                                                           
  File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_ssl.py", line 590, in test_openssl_version
    self.assertLess(n, 0x40000000)         
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^                                                                                                                                                           
AssertionError: 1073741824 not less than 1073741824     
                                                                                              
----------------------------------------------------------------------                                                                                                                       
Ran 1 test in 0.007s                      
FAILED (failures=1)                                                                                                                                                                          
test test_ssl failed
0:00:24 load avg: 3.07 [2/2/2] test_urllib2_localnet failed (2 errors)                                                                                                                       
Re-running test_urllib2_localnet in verbose mode (matching: test_https, test_https_sni)
test_https (test.test_urllib2_localnet.TestUrlopen.test_https) ... ERROR
stopping HTTPS server                                                                         
joining HTTPS thread                 
test_https_sni (test.test_urllib2_localnet.TestUrlopen.test_https_sni) ... ERROR
stopping HTTPS server            
joining HTTPS thread     
                                               
======================================================================
ERROR: test_https (test.test_urllib2_localnet.TestUrlopen.test_https)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 569, in test_https
    data = self.urlopen("https://localhost:%s/bizarre" % handler.port, context=context)
  File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 473, in urlopen
    l.extend(f.readlines(200))
             ~~~~~~~~~~~^^^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/http/client.py", line 714, in readline
    result = self.fp.readline(limit)
  File "/path/to/cpython/bump_multissl_awslc/Lib/socket.py", line 734, in readinto
    return self._sock.recv_into(b)
           ~~~~~~~~~~~~~~~~~~~~^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1355, in recv_into
    return self.read(nbytes, buffer)
           ~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1154, in read
    return self._sslobj.read(len, buffer)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
ssl.SSLError: A failure in the SSL library occurred (_ssl.c:2977)

======================================================================
ERROR: test_https_sni (test.test_urllib2_localnet.TestUrlopen.test_https_sni)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 585, in test_https_sni
    self.urlopen("https://localhost:%s" % handler.port, context=context)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 473, in urlopen
    l.extend(f.readlines(200))
             ~~~~~~~~~~~^^^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/http/client.py", line 714, in readline
    result = self.fp.readline(limit)
  File "/path/to/cpython/bump_multissl_awslc/Lib/socket.py", line 734, in readinto
    return self._sock.recv_into(b)
           ~~~~~~~~~~~~~~~~~~~~^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1355, in recv_into
    return self.read(nbytes, buffer)
           ~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1154, in read
    return self._sslobj.read(len, buffer)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
ssl.SSLError: A failure in the SSL library occurred (_ssl.c:2977)

----------------------------------------------------------------------
Ran 2 tests in 0.122s

FAILED (errors=2)
test test_urllib2_localnet failed
2 tests failed again:
    test_ssl test_urllib2_localnet

vstinner · 2026-03-20T16:58:19Z

I tested multissltests.py using:

python3 Tools/ssl/multissltests.py --steps=library --base-directory "$PWD/multissl" --openssl '4.0.0-alpha1' --system Linux
./configure --with-pydebug --with-openssl=$PWD/multissl/openssl/4.0.0-alpha1/
make

I fixed a few more issues, but make fails with OPENSSL_sk_set_thunks missing symbol:

[ERROR] _ssl failed to import: /home/vstinner/python/main/build/lib.linux-x86_64-3.15/_ssl.cpython-315d-x86_64-linux-gnu.so: undefined symbol: OPENSSL_sk_set_thunks
[ERROR] _ssl (/home/vstinner/python/main/build/lib.linux-x86_64-3.15/_ssl.cpython-315d-x86_64-linux-gnu.so) is missing

vstinner · 2026-03-20T16:58:55Z

there's a missing symlink (or openssl is just looking in the wrong place) for lib -> lib64 in the openssl install directory.

I fixed that with a5152be.

heitbaum · 2026-03-20T22:18:31Z

Tested results in #146207 (comment)

This reverts commit 5f9bc31.

vstinner · 2026-03-21T09:55:06Z

@picnixz @gpshead @zware: Would you mind to review this change?

I reverted the change to run "Tests / Ubuntu SSL tests (ubuntu-24.04, openssl, 4.0.0-alpha1)" CI job. I don't think that we should test alpha versions in our CI.

There are still two test_urllib2_localnet failures that I failed to fix. I cannot test OpenSSL 4 locally (on Fedora), I get an error about the OPENSSL_sk_set_thunks symbol (the CI wasn't impacted by this issue). IMO this PR is good enough for a first step to support OpenSSL 4.

Also, I think that we should backport the change to Python 3.13 and 3.14 to also prepare these branches to OpenSSL 4.

picnixz · 2026-03-21T10:06:31Z

I am not very fond of adding support in stable branches for an alpha version for now as I do not know if/how the ABI could change.

I do not mind having a presupport in 3.15 so that we can get feedback during our beta but I will take a look at what is planned in OpenSSL once I am at home.

miss-islington-app · 2026-03-25T06:44:52Z

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. (cherry picked from commit 3364e7e) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-25T06:45:16Z

GH-146403 is a backport of this pull request to the 3.14 branch.

OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. (cherry picked from commit 3364e7e) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2026-03-25T06:45:21Z

GH-146404 is a backport of this pull request to the 3.13 branch.

vstinner · 2026-03-25T06:48:18Z

I merged my PR. Thanks for reviews.

@picnixz:

I am not very fond of adding support in stable branches for an alpha version for now as I do not know if/how the ABI could change.

Oops, I forgot to remove "backport" labels. I closed the 3.13 and 3.14 backport PRs (without merging them).

vstinner · 2026-03-25T06:50:09Z

Oh, I understood the OPENSSL_sk_set_thunks symbol error: make clean removes all .so files and so removes libcrypto.so and libssl.so :-D The solution is to not run make clean or to create multissl/ directory outside CPython source tree. The workaround is to recreate the symlinks manually:

cd multissl/openssl/4.0.0-alpha1/lib64
ln -s libcrypto.so.4 libcrypto.so
ln -s libssl.so.4 libssl.so

hugovk · 2026-04-09T12:27:21Z

See also #148292 for ssl.SSLError: A failure in the SSL library occurred with 4.0.0-beta1.

thesamesam · 2026-04-15T02:27:11Z

@vstinner @picnixz Could we reopen the backport PRs? 4.0.0 final is out now. I have to admit I wasn't expecting it so soon either..

vstinner · 2026-04-15T09:33:04Z

@vstinner @picnixz Could we reopen the backport PRs? 4.0.0 final is out now. I have to admit I wasn't expecting it so soon either.

I created #148600 for OpenSSL 4.0.0 final. I'm also surprised with the short delay between the alpha1 and the final release (1 month and 4 days).

picnixz · 2026-04-15T09:35:46Z

I don't want to backport anything until we fixed the tests. I also don't want to backport anything until we have more feedback from the 3.15's beta. We can always backport OSSL 4.x support later for 3.13 and 3.14.

OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

The default Python stack in Fedora Rawhide was updated from version 3.14 to 3.15 [1], and OpenSSL 4.0 was introduced [2]. As a result of this combination, the PROTOCOL_TLSv1 attribute disappeared from Python's ssl module [3]. This prevents Zuul from working with Fedora Rawhide hosts, because of this Ansible error: TASK [add-build-sshkey : Enable access via build key on all nodes] *** An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AttributeError: module 'ssl' has no attribute 'PROTOCOL_TLSv1'. Did you mean '.PROTOCOL_TLS' instead of '.PROTOCOL_TLSv1'? The use of ssl.PROTOCOL_TLSv1 was removed from ansible-core 2.17.0 [4], which became available in Ansible 10 [5]; and since Zuul 13.0.0, the default Ansible version is 9, and version 11 can be optionally used. Therefore, explicitly selecting Ansible 11 resolves this breakage when the combination of Python 3.15 and OpenSSL 4.0 are used. [1] https://fedoraproject.org/wiki/Changes/Python3.15 [2] https://fedoraproject.org/wiki/Changes/OpenSSL40 [3] CPython commit 3364e7e62fa24d0e python/cpython@3364e7e62fa24d0e python/cpython#146217 python/cpython#146207 [4] ansible-core commit 92d2c66db2eecd0f ansible/ansible@92d2c66db2eecd0f ansible/ansible#81880 [5] https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.md [6] https://zuul-ci.org/docs/zuul/latest/releasenotes.html containers#1824 Signed-off-by: Tristan Cacqueray <tdecacqu@redhat.com>

The default Python stack in Fedora Rawhide was updated from version 3.14 to 3.15 [1], and OpenSSL 4.0 was introduced [2]. As a result of this combination, the PROTOCOL_TLSv1 attribute disappeared from Python's ssl module [3]. This prevents Zuul from working with Fedora Rawhide hosts, because of this Ansible error: TASK [add-build-sshkey : Enable access via build key on all nodes] *** An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AttributeError: module 'ssl' has no attribute 'PROTOCOL_TLSv1'. Did you mean '.PROTOCOL_TLS' instead of '.PROTOCOL_TLSv1'? The use of ssl.PROTOCOL_TLSv1 was removed from ansible-core 2.17.0 [4], which became available in Ansible 10 [5,6]; and since Zuul 13.0.0, the default Ansible version is 9, and version 11 can be optionally used [7]. Therefore, explicitly selecting Ansible 11 resolves this breakage when the combination of Python 3.15 and OpenSSL 4.0 are used. [1] https://fedoraproject.org/wiki/Changes/Python3.15 [2] https://fedoraproject.org/wiki/Changes/OpenSSL40 [3] CPython commit 3364e7e62fa24d0e python/cpython@3364e7e62fa24d0e python/cpython#146217 python/cpython#146207 [4] ansible-core commit 92d2c66db2eecd0f ansible/ansible@92d2c66db2eecd0f ansible/ansible#81880 [5] https://docs.ansible.com/projects/ansible/latest/reference_appendices/release_and_maintenance.html [6] https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.md [7] https://zuul-ci.org/docs/zuul/latest/releasenotes.html containers#1824 Signed-off-by: Tristan Cacqueray <tdecacqu@redhat.com>

pythongh-146207: Add support for OpenSSL 4.0.0 alpha1

9359f01

OpenSSL 4.0.0 alpha1 no longer defines the symbols: * SSLv3_method * TLSv1_method * TLSv1_1_method * TLSv1_2_method

vstinner requested review from gpshead and picnixz as code owners March 20, 2026 15:53

bedevere-app Bot mentioned this pull request Mar 20, 2026

Building with OpenSSL-4.0.0-alpha1 fails with #146207

Closed

bedevere-app Bot added the awaiting core review label Mar 20, 2026

Test openssl-4.0.0-alpha1 in GitHub Action

5f9bc31

vstinner requested review from AA-Turner, ezio-melotti, hugovk and webknjaz as code owners March 20, 2026 16:20

Update test_openssl_version()

8e607c4

vstinner marked this pull request as draft March 20, 2026 16:42

bedevere-app Bot removed the awaiting core review label Mar 20, 2026

vstinner added 2 commits March 20, 2026 17:45

Update multissltests.py for OpenSSL 4

a5152be

Add const qualifier to fix compiler warnings

4ee447a

heitbaum mentioned this pull request Mar 20, 2026

OpenSSL: update to 4.0.x LibreELEC/LibreELEC.tv#11104

Open

Revert "Test openssl-4.0.0-alpha1 in GitHub Action"

71e9c1a

This reverts commit 5f9bc31.

vstinner marked this pull request as ready for review March 21, 2026 09:50

bedevere-app Bot added the awaiting core review label Mar 21, 2026

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 21, 2026

Don't advertize this early work: remove the NEWS entry

a3f1c62

hugovk added the skip news label Mar 24, 2026

Merge branch 'main' into openssl4

0963272

vstinner merged commit 3364e7e into python:main Mar 25, 2026
49 checks passed

vstinner deleted the openssl4 branch March 25, 2026 06:44

bedevere-app Bot removed the awaiting core review label Mar 25, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Mar 25, 2026

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Mar 25, 2026

pablogsal mentioned this pull request Apr 4, 2026

gh-130273: Fix traceback color output with unicode characters #142529

Merged

hugovk mentioned this pull request Apr 9, 2026

3.15.0a8 fails test_urllib2_localnet with OpenSSL 4.0.0beta1 #148292

Closed

This was referenced Apr 15, 2026

Add support for OpenSSL 4.0.0 final #148600

Closed

gh-148292: Update SSLSocket.read() for OpenSSL 4 #148602

Closed

cho-m mentioned this pull request May 9, 2026

python@3.14: migrate to openssl@4 Homebrew/homebrew-core#280846

Closed

QuLogic mentioned this pull request Jun 19, 2026

PROTOCOL_TLSv* are deprecated (and possibly removed) fsspec/filesystem_spec#2053

Closed

Uh oh!

Uh oh!

Conversation

vstinner commented Mar 20, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Mar 20, 2026

Uh oh!

zware commented Mar 20, 2026

Uh oh!

vstinner commented Mar 20, 2026

Uh oh!

zware commented Mar 20, 2026

Uh oh!

vstinner commented Mar 20, 2026

Uh oh!

vstinner commented Mar 20, 2026

Uh oh!

heitbaum commented Mar 20, 2026

Uh oh!

vstinner commented Mar 21, 2026

Uh oh!

picnixz commented Mar 21, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Mar 25, 2026

Uh oh!

bedevere-app Bot commented Mar 25, 2026

Uh oh!

bedevere-app Bot commented Mar 25, 2026

Uh oh!

vstinner commented Mar 25, 2026

Uh oh!

vstinner commented Mar 25, 2026

Uh oh!

hugovk commented Apr 9, 2026

Uh oh!

thesamesam commented Apr 15, 2026

Uh oh!

vstinner commented Apr 15, 2026

Uh oh!

picnixz commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vstinner commented Mar 20, 2026 •

edited by bedevere-app Bot

Loading