GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.14] gh-148292: Add OpenSSL 4 support by vstinner · Pull Request #149783 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented May 13, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: 3.15.0a8 fails test_urllib2_localnet with OpenSSL 4.0.0beta1 #148292

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
thesamesam reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
vstinner and others added 5 commits May 13, 2026 17:02
@vstinner @picnixz
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
cf23df4 
OpenSSL 4.0.0 alpha1 removed these functions:

* SSLv3_method()
* TLSv1_method()
* TLSv1_1_method()
* TLSv1_2_method()

Other changes:

* Update test_openssl_version().
* Update multissltests.py for OpenSSL 4.
* Add const qualifier to fix compiler warnings.

Co-authored-by: Bénédikt Tran <[email protected]>
(cherry picked from commit 3364e7e)
@vstinner
pythongh-148600: Add Modules/_ssl_data_40.h data (python#148601)
c5e4ae0 
The Modules/_ssl_data_40.h file was created with the commands:

python Tools/ssl/multissltests.py --steps=library --base-directory "$PWD/multissl" --openssl '4.0.0' --system Linux
python Tools/ssl/make_ssl_data.py multissl/src/openssl-4.0.0 Modules/_ssl_data_40.h

Update Modules/_ssl.c to include it on OpenSSL 4.0.0 and newer.

Update test_ssl for the new error message.

(cherry picked from commit 70eb56b)
@vstinner @gpshead
pythongh-148292: Update _ssl._SSLSocket for OpenSSL 4 (python#149102)
3c2a301 
The _SSLSocket object now remembers if it gets an EOF error. In this
case, read(), sendfile(), write() and do_handshake method calls fail
with SSLEOFError without calling the underlying OpenSSL function.

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 7b7fa3f)
@vstinner
pythongh-148292: Remove shutdown() test in test_ssl.test_got_eof() (p…
8191190 
…ython#149366)

The shutdown() behavior depends too much on the operating system and
it's unrelated to the got_eof_error change.

(cherry picked from commit 1e21cf6)
@vstinner @clin1234
pythongh-148600: Add OpenSSL 4.0.0 support to test configurations (py…
c9a39e6 
…thon#149356)

Co-authored-by: Charlie Lin <[email protected]>
(cherry picked from commit fc96028)
@vstinner
vstinner requested review from a team, gpshead and picnixz as code owners May 13, 2026 15:15
@vstinner vstinner added the needs backport to 3.13 only security fixes label May 13, 2026
@vstinner
vstinner requested review from AA-Turner, ezio-melotti, hugovk and webknjaz as code owners May 13, 2026 15:15
@bedevere-app bedevere-app Bot mentioned this pull request May 13, 2026
3.15.0a8 fails test_urllib2_localnet with OpenSSL 4.0.0beta1 #148292
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label May 13, 2026
@vstinner
Merge branch '3.14' into openssl4
92c9daf
@vstinner

vstinner commented May 15, 2026

Copy link
Copy Markdown
Member Author

@picnixz @gpshead: Would you mind to review this change? Are you ok with backporting OpenSSL 4.0.0 support to Python 3.13 and 3.14 branches?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cho-m cho-m mentioned this pull request May 18, 2026
[email protected]: migrate to openssl@4 Homebrew/homebrew-core#280846
Closed
@vstinner

vstinner commented May 21, 2026

Copy link
Copy Markdown
Member Author

Ping @picnixz @gpshead. Are you ok with adding OpenSSL 4.0.0 support for Python 3.14?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented May 21, 2026

Copy link
Copy Markdown
Member

Can we wait a bit before doing so? I do not want to fix openssl issues arising in a bugfix because we added support for OSSL4. It is a major change and for instance, I did not backport the use of the EVP API introduced in 3.x for HMAC to older releases.

I really want to wait for users to test 3.15 with 4.0, say until aftrr 3.15.1, and we can add it to 3.14 afterwards. It would not help backports though as each version has its own ssl.c (almost)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner

vstinner commented May 21, 2026

Copy link
Copy Markdown
Member Author

Ok, in this case, I prefer closing my PR. For my own workflow, I prefer to not keep PRs opens for too long. The PR can be reopened/recreated later.
picnixz reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner vstinner closed this May 21, 2026
@vstinner
vstinner deleted the openssl4 branch May 21, 2026 11:35
@vstinner vstinner mentioned this pull request May 26, 2026
Add support for OpenSSL 4.0.0 final #148600
Closed
@native-api

native-api commented May 30, 2026

Copy link
Copy Markdown
Contributor

@vstinner We have applied this backport downstream in Pyenv so that users can link against OpenSSL 4 if they wish / if it's the default on their system.

Is it reasonable to expect that if there are further OpenSSL 4 -- related fixes before the official backport, they will be added to this PR?
vstinner reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mattip mattip mentioned this pull request May 31, 2026
OpenSSL 4.x support pypy/pypy#5489
Open
@vstinner

vstinner commented Jun 1, 2026

Copy link
Copy Markdown
Member Author

We can revisit (reopen) this PR later. If this PR is reopened, we will add further changes if there are more OpenSSL 4.0 changes.

@picnixz would like to wait for user feedback testing Python 3.15 with OpenSSL 4.0.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Jun 1, 2026

Copy link
Copy Markdown
Member

Yes I want to wait at least until 3.15.0 is out and we can reconsider this in 3.15.1.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@majabojarska majabojarska mentioned this pull request Jun 16, 2026
chore: update dependencies 2026-06-16 siderolabs/tools#545
Merged
@coderabbitai coderabbitai Bot mentioned this pull request Jul 24, 2026
Friday update redroselinux/car3-pkgs#10
Merged
@mattip mattip mentioned this pull request Sep 29, 2026
Add PyPy v8.0.0 pyenv/pyenv#3552
Merged
3 tasks done
This was referenced Oct 13, 2026
fix: pin OpenSSL to 3.x in the image builders kyma-project/kyma-companion#1479
Merged
fix: pin OpenSSL to 3.x in the image builders kyma-project/kyma-companion#1480
Closed
@thesamesam

thesamesam commented Oct 31, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Could this one be reconsidered now please? OpenSSL 3.6.x is EOL, so people are stuck on 3.5.x or >=4.x now.

3.15 seems okay for me except for:

  • gh-159387: Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0 #159388 (breaks mercurial)
  • test.test_httplib.HTTPSTest.test_networked_good_cert fails with OpenSSL 4.1.0 #160823 w/ 4.1.0
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Oct 31, 2026

Copy link
Copy Markdown
Member

OpenSSL 3.6.x is EOL

Wow, I thought 3.6 was the LTS and not 3.5 (I think I was biased bc of Python 3.6 which lasted longer in many distros compared to 3.5). I don't think being "stuck" in 3.5 is a problem though (but I may once again have mixed the supported features).

That being said, let's first fix the 4.x support in 3.15+ before backporting anything, indeed.
thesamesam reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead Awaiting requested review from gpshead gpshead is a code owner
@picnixz picnixz Awaiting requested review from picnixz picnixz is a code owner
@ezio-melotti ezio-melotti Awaiting requested review from ezio-melotti ezio-melotti is a code owner
@hugovk hugovk Awaiting requested review from hugovk hugovk is a code owner
@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner
@webknjaz webknjaz Awaiting requested review from webknjaz webknjaz is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting core review needs backport to 3.13 only security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@vstinner @picnixz @native-api @thesamesam
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.