https://github.com/python/cpython/commit/e7acd6a82f2feec196b84fdfc1d1533e37024221
commit: e7acd6a82f2feec196b84fdfc1d1533e37024221
branch: main
author: Pengyu Lee <[email protected]>
committer: gpshead <[email protected]>
date: 2026-10-31T23:27:07Z
summary:
gh-159387: Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0 (GH-159388)
Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0
OpenSSL 4.0 removed the version-specific methods but still supports
TLS 1.0–1.2 through TLS_method(). Stop reporting these versions as
unavailable, and expose legacy PROTOCOL_TLSv1* constants only when their
corresponding methods exist.
files:
A Misc/NEWS.d/next/Library/2026-10-14-10-26-10.gh-issue-159387.xMbQbB.rst
M Lib/test/test_ssl.py
M Modules/_ssl.c
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 7c69210263f073..5b4e4f08060772 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -4567,6 +4567,8 @@ def test_protocol_tlsv1_1(self):
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
@requires_tls_version('TLSv1_2')
+ @unittest.skipUnless(hasattr(ssl, 'PROTOCOL_TLSv1_2'),
+ 'needs ssl.PROTOCOL_TLSv1_2')
def test_protocol_tlsv1_2(self):
"""Connecting to a TLSv1.2 server with various client options.
Testing against older TLS versions."""
diff --git
a/Misc/NEWS.d/next/Library/2026-10-14-10-26-10.gh-issue-159387.xMbQbB.rst
b/Misc/NEWS.d/next/Library/2026-10-14-10-26-10.gh-issue-159387.xMbQbB.rst
new file mode 100644
index 00000000000000..fddef6e097ba5c
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-10-14-10-26-10.gh-issue-159387.xMbQbB.rst
@@ -0,0 +1,2 @@
+Fix :mod:`ssl` reporting TLS 1.0, 1.1, and 1.2 as unavailable when built
+with OpenSSL 4.0, despite support for these protocol versions.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index dc6cf28fc8658f..2e4c67b4058bc3 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -148,10 +148,9 @@ static void _PySSLFixErrno(void) {
#endif
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+/* OpenSSL 4.0 removed SSLv3 and the version-specific methods,
+ * but TLS 1.0, 1.1 and 1.2 are still available via TLS_method(). */
# define OPENSSL_NO_SSL3
-# define OPENSSL_NO_TLS1
-# define OPENSSL_NO_TLS1_1
-# define OPENSSL_NO_TLS1_2
# define OPENSSL_NO_SSL3_METHOD
# define OPENSSL_NO_TLS1_METHOD
# define OPENSSL_NO_TLS1_1_METHOD
@@ -7526,13 +7525,13 @@ sslmodule_init_constants(PyObject *m)
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
-#ifndef OPENSSL_NO_TLS1
+#if !defined(OPENSSL_NO_TLS1) && !defined(OPENSSL_NO_TLS1_METHOD)
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
#endif
-#ifndef OPENSSL_NO_TLS1_1
+#if !defined(OPENSSL_NO_TLS1_1) && !defined(OPENSSL_NO_TLS1_1_METHOD)
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
#endif
-#ifndef OPENSSL_NO_TLS1_2
+#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_TLS1_2_METHOD)
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
#endif
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
