[Bug 1899878] Re: Python's test_ssl fails starting from Ubuntu 20.04

[Christian Heimes]

In upstream OpenSSL, (3) is the same as (1) for a pristine
SSL_CTX_new(TLS_method()) context.

As far as I can see, the Ubuntu patch effectively sets the minimum
version to TLS 1.2 and prevents users from setting TLS 1.0 and 1.1. I
propose that the patch also changes the value of minimum protocol on the
CTX, so (1) reports TLS1_2_VERSION as current value.

OpenSSL upstream is not going to accept a new function into 1.1.1 LTS
branch.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1899878

Title:
  Python's test_ssl fails starting from Ubuntu 20.04

Status in openssl package in Ubuntu:
  Incomplete

Bug description:
  Please take a look at https://bugs.python.org/issue41561. Developers
  who work on Python think that the issue is due to a change in Ubuntu
  20.04 that is best described by
  https://bugs.python.org/issue41561#msg378089:

  "It sounds like a Debian/Ubuntu patch is breaking an assumption. Did
  somebody report the bug with Debian/Ubuntu maintainers of OpenSSL
  already? Fedora also configures OpenSSL with minimum protocol version
  of TLS 1.2. The distribution does it in a slightly different way that
  makes the restriction discoverable and that is compatible with
  Python's test suite."

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878/+subscriptions