GeezerVison


[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_2_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: SSLv3_method

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

Reacted by Sam James

Activity

heitbaum
added
type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
on Mar 20, 2026

vstinner commented on Mar 20, 2026

vstinner

on Mar 20, 2026

Member

More actions

Hi,

It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2eb31229a9b..829b0598d5d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
 #error Unsupported OpenSSL version
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+#  define OPENSSL_NO_SSL3
+#  define OPENSSL_NO_TLS1
+#  define OPENSSL_NO_TLS1_1
+#  define OPENSSL_NO_TLS1_2
+#endif
+
 /* OpenSSL API 1.1.0+ does not include version methods */
 #ifndef OPENSSL_NO_SSL3_METHOD
 extern const SSL_METHOD *SSLv3_method(void);
@@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
     ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
     ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
     ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
+#ifndef OPENSSL_NO_TLS1
     ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
+#endif
+#ifndef OPENSSL_NO_TLS1_1
     ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
+#endif
+#ifndef OPENSSL_NO_TLS1_2
     ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
+#endif
 
 #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

vstinner commented on Mar 20, 2026
vstinner
on Mar 20, 2026
Member
More actions
cc @picnixz
heitbaum commented on Mar 20, 2026
heitbaum
on Mar 20, 2026
ContributorAuthor
More actions

Hi,

It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2eb31229a9b..829b0598d5d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
#error Unsupported OpenSSL version
#endif

+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+# define OPENSSL_NO_SSL3
+# define OPENSSL_NO_TLS1
+# define OPENSSL_NO_TLS1_1
+# define OPENSSL_NO_TLS1_2
+#endif
+
/* OpenSSL API 1.1.0+ does not include version methods */
#ifndef OPENSSL_NO_SSL3_METHOD
extern const SSL_METHOD *SSLv3_method(void);
@@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
+#ifndef OPENSSL_NO_TLS1
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
+#endif
+#ifndef OPENSSL_NO_TLS1_1
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
+#endif
+#ifndef OPENSSL_NO_TLS1_2
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
+#endif

#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1
Reacted by Victor Stinner and Perfect Gentleman
aisk
added
buildThe build process and cross-buildThe build process and cross-build

topic-SSL
on Mar 20, 2026
vstinner
added 2 commits that reference this issue on Mar 20, 2026
pythongh-146207: Add support for OpenSSL-4.0.0-alpha1
15e8779
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1
9359f01
vstinner commented on Mar 20, 2026
vstinner
on Mar 20, 2026
Member
More actions

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

heitbaum commented on Mar 20, 2026

heitbaum

on Mar 20, 2026

ContributorAuthor

More actions

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

Tested successfully - as attached - needed a minor change to backport the tests to 3.14.3

test.log

--- Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:33.274279599 +0000
+++ Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:04.786740174 +0000
@@ -1087,7 +1087,7 @@
         ctx.maximum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
         self.assertIn(
             ctx.maximum_version,
-            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.SSLv3}
+            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, ssl.TLSVersion.TLSv1_3, ssl.TLSVersion.SSLv3}
         )

         ctx.minimum_version = ssl.TLSVersion.MAXIMUM_SUPPORTED

Reacted by Victor Stinner

picnixz
added
extension-modulesC modules in the Modules dirC modules in the Modules dir
on Mar 20, 2026
vstinner
added a commit that references this issue on Mar 25, 2026
gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217)
3364e7e
miss-islington
added 2 commits that reference this issue on Mar 25, 2026
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)
b9eb9f7
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)
d7b6e66
vstinner commented on Mar 25, 2026
vstinner
on Mar 25, 2026
Member
More actions
I merged my PR in the main branch. So you can now use the main branch unmodified to test OpenSSL 4.0.0. alpha1.

test_urllib2_localnet still fails, it will require a separated fix: #146217 (comment)

It was decided to not backport the change to 3.13 and 3.14 since OpenSSL 4 is still an alpha version.
vstinner
closed this as completed on Mar 25, 2026
heitbaum commented on Mar 25, 2026
heitbaum
on Mar 25, 2026
ContributorAuthor
More actions

I merged my PR in the main branch. So you can now use the main branch unmodified to test OpenSSL 4.0.0. alpha1.

test_urllib2_localnet still fails, it will require a separated fix: #146217 (comment)

It was decided to not backport the change to 3.13 and 3.14 since OpenSSL 4 is still an alpha version.

Thanks. Completely understood on the “alpha/beta” stuff. I have done a successful test build of the backported version against OpenSSL 4.0.0-beta1. And will do run testing. I’ll keep tracking OpenSSL’s progress.

3.14.3 + miss-islington@f24009f + [3.14] gh-146207: Add support for OpenSSL 4.0.0 alpha1 (GH-146217) #146403

Reacted by Victor Stinner
Reacted by Victor Stinner
ross-alexander commented on Apr 15, 2026
ross-alexander
on Apr 15, 2026 · Hidden as off-topic
show commentMore actions
zware commented on Apr 15, 2026
zware
on Apr 15, 2026 · Hidden as off-topic
show commentMore actions
vstinner commented on Apr 16, 2026
vstinner
on Apr 16, 2026
Member
More actions
See the follow-up issue: issue gh-148600 "Add support for OpenSSL 4.0.0 final".
clin1234
added a commit that references this issue on Apr 16, 2026
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
a715ed4
SquallATF
added a commit that references this issue on Apr 22, 2026
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
d8863f8
ljfp
added a commit that references this issue on Apr 25, 2026
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
8e43cab
debarshiray
added 2 commits that reference this issue on Jul 23, 2026
.zuul: Unbreak the CI on Fedora Rawhide hosts
b935371
.zuul: Unbreak the CI on Fedora Rawhide hosts
93f882c
SquallATF
added a commit that references this issue on Oct 9, 2026
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
4135bf7
bmiesch
added 2 commits that reference this issue on Oct 19, 2026
Fix tls_set() default when ssl.PROTOCOL_TLSv1_2 is missing
fbbfe2d
Fix tls_set() default when ssl.PROTOCOL_TLSv1_2 is missing
b95385c
mehw
added a commit that references this issue on Nov 6, 2026
Fix compiling Python 2.7.18 with OpenSSL 4
5a2dd8e

Metadata

Assignees

No one assigned

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Building with OpenSSL-4.0.0-alpha1 fails with #146207

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

vstinner commented on Mar 20, 2026

vstinner commented on Mar 20, 2026

heitbaum commented on Mar 20, 2026

vstinner commented on Mar 20, 2026

heitbaum commented on Mar 20, 2026

vstinner commented on Mar 25, 2026

heitbaum commented on Mar 25, 2026

ross-alexander commented on Apr 15, 2026

zware commented on Apr 15, 2026

vstinner commented on Apr 16, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions