[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: Okay so for the record, the maintainence branches were changed over from svn.python.org to self-signed.pythontest.net, and just now I changed the 3.6 branch to use a local server for most tests. -- resolution: -> fixed stage: patch review -> resolved

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Roundup Robot added the comment: New changeset 3da812602881 by Martin Panter in branch 'default': Issue #25940: Use internal local server more in test_ssl https://hg.python.org/cpython/rev/3da812602881 -- ___ Python tracker

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Roundup Robot added the comment: New changeset 81b3beea7e99 by Georg Brandl in branch '3.2': Issue #25940: Backport self-signed.pythontest.net testing for test_httplib https://hg.python.org/cpython/rev/81b3beea7e99 New changeset adf750b1252d by Martin Panter in branch '3.2': Issue #25940: Use

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

koobs added the comment: Wow. *thank you* Georg and Martin :) -- ___ Python tracker ___ ___ Python-bugs-list

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Roundup Robot added the comment: New changeset b2036b717028 by Martin Panter in branch '3.2': Issue #25940: On Windows, connecting to port 444 returns ETIMEDOUT https://hg.python.org/cpython/rev/b2036b717028 New changeset c5cae7366835 by Martin Panter in branch '3.3': Issue #25940: Merge

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Roundup Robot added the comment: New changeset fb7131939508 by Martin Panter in branch '2.7': Issue #25940: Use self-signed.pythontest.net in SSL tests https://hg.python.org/cpython/rev/fb7131939508 -- ___ Python tracker

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: In the 3.3 branch, I got a failure in test_ssl.ThreadedTests.test_dh_params(): “SSLError: [SSL] dh key too small (_ssl.c:548)”. But the failure also happens in the revision before my merge, so I think it must be a separate problem. Also, I am seeing Windows 7+

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: Here is the corresponding patch for the test suite. This version should fix all the SSL tests as long as the server is updated. -- Added file: http://bugs.python.org/file41590/use-pythontest.v2.patch ___ Python

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: This is a patch against the pythontestdotnet repository to change the certificate to have the CA flag set. It should be applied in conjunction with an (upcoming) update to the test suite, otherwise test_httplib will fail with certificate verification errors.

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Marc-Andre Lemburg added the comment: The patch looks good. I only have one question: Why are you removing this part ? ... @@ -1684,13 +1688,8 @@ try: ret = func(*args) except ssl.SSLError as e: -# Note that we get a spurious

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: In python-dev I offered to make a patch to switch to https://self-signed.pythontest.net. Here is my patch so far. There is one outstanding problem though: test_get_ca_certs_capath() fails. I think it is because the self-signed certificate does not have a “CA

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Vincent Legoll added the comment: Maybe if the server change is not approved you can still push the part of the patch that un-hardwire that server name everywhere... -- ___ Python tracker

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

koobs added the comment: As many branches as we can muster, ideally all, at least 3.4, 3.5 default and 2.7 please. Back porting is a massive pain, and downstream OS's want to retain integrity of tests to ensure quality of Python in their respective ecosystems --

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Changes by Senthil Kumaran : -- assignee: -> martin.panter ___ Python tracker ___ ___

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Changes by Jason Madden : -- nosy: +jmadden ___ Python tracker ___ ___

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: After looking into the unwrap() problem more, I think I understand the problem, and believe making the server call unwrap() is the correct way forward. SSL_ERROR_SYSCALL is Open SSL’s way of saying the connection was shut down insecurely (among other things).

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: Koobs: What thing are you suggesting to mock? The remote server perhaps, which is what I want to do too? Here is a patch that implements my local SSL server idea by reusing ThreadedEchoServer. There is one problem with local-server.patch, and I don’t know how

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Marc-Andre Lemburg added the comment: On 04.01.2016 08:43, Martin Panter wrote: > > In the meantime, this patch changes the tests to use the new DST root > certificate. This seems to be the minimum to make the tests pass again, but > someone else should probably review it because I’m not too

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

koobs added the comment: Can't / Shouldn't these be mocked? -- ___ Python tracker ___ ___ Python-bugs-list

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: Assuming it is practical, would it be appropriate to convert the failing tests to connect to a local server running in a background Python thread? Perhaps using the existing ThreadedEchoServer. That way the tests wouldn’t require an internet connection, and

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Martin Panter added the comment: In the meantime, this patch changes the tests to use the new DST root certificate. This seems to be the minimum to make the tests pass again, but someone else should probably review it because I’m not too experienced with SSL certificate stuff. --

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Stefan Krah added the comment: Setting to blocker because I've disabled the offending tests. -- nosy: +georg.brandl, larry, skrah priority: high -> release blocker ___ Python tracker

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Roundup Robot added the comment: New changeset 9d0c15425b59 by Stefan Krah in branch 'default': Issue #25940: Make buildbots usable again until a solution is found. https://hg.python.org/cpython/rev/9d0c15425b59 -- nosy: +python-dev ___ Python

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Ernest W. Durbin III added the comment: Currently svn.python.org is served from one of the last remaining "unmanaged" boxes in our infrastructure, dinsdale.python.org. If a cacert signed certificate can be supplied, it can be installed. I see a tree of them in

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Alex Gaynor added the comment: I agree the tests shouldn't rely on a legacy domain like svn.python.org In the mean time Ernest is working on getting a valid cert set up. -- nosy: +alex ___ Python tracker

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

koobs added the comment: I'm here from (duplicate) issue 25950 -- nosy: +koobs priority: normal -> high ___ Python tracker ___

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Marc-Andre Lemburg added the comment: Regardless of the cert having expired, I think SSL tests either should use the main python.org site, e.g. https://www.python.org/ or the domain we specifically have for stdlib tests: http://pythontest.net/. Benjamin: If you need a cert for pythontest.net,

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

Alex Gaynor added the comment: There's good news and bad news, which do you want first? Good news, great! svn.python.org now has a certificate that's not expired, and it's even trusted by major trust stores. Bad news? The tests rely on the cert for svn.python.org specifically be a cacert

[issue25940] SSL tests failed due to expired svn.python.org SSL certificate

New submission from Chi Hsuan Yen: The certificate of svn.python.org expires at Thu 24 Dec 2015 08:28:32 PM CST GMT, about 20 minutes ago. Please update its certificate or lots of tests in Lib\test\test_ssl.py fails with SSL: CERTIFICATE_VERIFY_FAILED. -- components: Tests messages: