Skip to content

Building with OpenSSL-4.0.0-alpha1 fails with #146207

Closed
Closed
Building with OpenSSL-4.0.0-alpha1 fails with#146207
Labels
buildThe build process and cross-buildextension-modulesC modules in the Modules dirtopic-SSLtype-bugAn unexpected behavior, bug, or error

Description

@heitbaum
heitbaum
opened on Mar 20, 2026

Bug report

Bug description:

Build fails with the following errors.


[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_2_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: SSLv3_method

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

Activity

  1. heitbaum
    added
    type-bugAn unexpected behavior, bug, or error
    on Mar 20, 2026

  2. vstinner commented on Mar 20, 2026

    @vstinner
    vstinner
    on Mar 20, 2026
    Member

    Hi,

    It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

    diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2eb31229a9b..829b0598d5d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
 #error Unsupported OpenSSL version
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+#  define OPENSSL_NO_SSL3
+#  define OPENSSL_NO_TLS1
+#  define OPENSSL_NO_TLS1_1
+#  define OPENSSL_NO_TLS1_2
+#endif
+
 /* OpenSSL API 1.1.0+ does not include version methods */
 #ifndef OPENSSL_NO_SSL3_METHOD
 extern const SSL_METHOD *SSLv3_method(void);
@@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
     ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
     ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
     ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
+#ifndef OPENSSL_NO_TLS1
     ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
+#endif
+#ifndef OPENSSL_NO_TLS1_1
     ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
+#endif
+#ifndef OPENSSL_NO_TLS1_2
     ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
+#endif
 
 #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

  3. vstinner commented on Mar 20, 2026

    @vstinner
    vstinner
    on Mar 20, 2026
    Member

    cc @picnixz

  4. heitbaum commented on Mar 20, 2026

    @heitbaum
    heitbaum
    on Mar 20, 2026
    ContributorAuthor

    Hi,

    It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

    diff --git a/Modules/_ssl.c b/Modules/_ssl.c
    index 2eb31229a9b..829b0598d5d 100644
    --- a/Modules/_ssl.c
    +++ b/Modules/_ssl.c
    @@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
    #error Unsupported OpenSSL version
    #endif

    +#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
    +# define OPENSSL_NO_SSL3
    +# define OPENSSL_NO_TLS1
    +# define OPENSSL_NO_TLS1_1
    +# define OPENSSL_NO_TLS1_2
    +#endif
    +
    /* OpenSSL API 1.1.0+ does not include version methods */
    #ifndef OPENSSL_NO_SSL3_METHOD
    extern const SSL_METHOD *SSLv3_method(void);
    @@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
    ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
    ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
    ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
    +#ifndef OPENSSL_NO_TLS1
    ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
    +#endif
    +#ifndef OPENSSL_NO_TLS1_1
    ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
    +#endif
    +#ifndef OPENSSL_NO_TLS1_2
    ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
    +#endif

    #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

    I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

  5. aisk
    added
    buildThe build process and cross-build
    topic-SSL
    on Mar 20, 2026
  6. vstinner
    added 2 commits that reference this issue on Mar 20, 2026

    pythongh-146207: Add support for OpenSSL-4.0.0-alpha1

    15e8779

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1

    9359f01

  7. vstinner commented on Mar 20, 2026

    @vstinner
    vstinner
    on Mar 20, 2026
    Member

    I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

    Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

  8. heitbaum commented on Mar 20, 2026

    @heitbaum
    heitbaum
    on Mar 20, 2026
    ContributorAuthor

    I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

    Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

    Tested successfully - as attached - needed a minor change to backport the tests to 3.14.3

    test.log

    --- Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:33.274279599 +0000
+++ Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:04.786740174 +0000
@@ -1087,7 +1087,7 @@
         ctx.maximum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
         self.assertIn(
             ctx.maximum_version,
-            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.SSLv3}
+            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, ssl.TLSVersion.TLSv1_3, ssl.TLSVersion.SSLv3}
         )

         ctx.minimum_version = ssl.TLSVersion.MAXIMUM_SUPPORTED
  9. picnixz
    added
    extension-modulesC modules in the Modules dir
    on Mar 20, 2026
  10. vstinner
    added a commit that references this issue on Mar 25, 2026

    gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217)

    3364e7e
  11. miss-islington
    added 2 commits that reference this issue on Mar 25, 2026

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)

    b9eb9f7

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)

    d7b6e66

  12. vstinner commented on Mar 25, 2026

    @vstinner
    vstinner
    on Mar 25, 2026
    Member

    I merged my PR in the main branch. So you can now use the main branch unmodified to test OpenSSL 4.0.0. alpha1.

    test_urllib2_localnet still fails, it will require a separated fix: #146217 (comment)

    It was decided to not backport the change to 3.13 and 3.14 since OpenSSL 4 is still an alpha version.

  13. vstinner
    closed this as completedon Mar 25, 2026

  14. heitbaum commented on Mar 25, 2026

    @heitbaum
    heitbaum
    on Mar 25, 2026
    ContributorAuthor

    I merged my PR in the main branch. So you can now use the main branch unmodified to test OpenSSL 4.0.0. alpha1.

    test_urllib2_localnet still fails, it will require a separated fix: #146217 (comment)

    It was decided to not backport the change to 3.13 and 3.14 since OpenSSL 4 is still an alpha version.

    Thanks. Completely understood on the “alpha/beta” stuff. I have done a successful test build of the backported version against OpenSSL 4.0.0-beta1. And will do run testing. I’ll keep tracking OpenSSL’s progress.

  15. ross-alexander commented on Apr 15, 2026

    @ross-alexander
    ross-alexander
    on Apr 15, 2026 · Hidden as off-topic

  16. zware commented on Apr 15, 2026

    @zware
    zware
    on Apr 15, 2026 · Hidden as off-topic

  17. vstinner commented on Apr 16, 2026

    @vstinner
    vstinner
    on Apr 16, 2026
    Member

    See the follow-up issue: issue gh-148600 "Add support for OpenSSL 4.0.0 final".

  18. clin1234
    added a commit that references this issue on Apr 16, 2026

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)

    a715ed4
  19. SquallATF
    added a commit that references this issue on Apr 22, 2026

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)

    d8863f8
  20. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)

    8e43cab
  21. debarshiray
    added 2 commits that reference this issue on Jul 23, 2026

    .zuul: Unbreak the CI on Fedora Rawhide hosts

    b935371

    .zuul: Unbreak the CI on Fedora Rawhide hosts

    93f882c
  22. SquallATF
    added a commit that references this issue on Oct 9, 2026

    pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)

    4135bf7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    buildThe build process and cross-buildextension-modulesC modules in the Modules dirtopic-SSLtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions