Certbot failing with problem with openSSL Configuration

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: mail.chandlerfamily.org.uk

I ran this command:
certbot list

It produced this output:
Traceback (most recent call last):
File "/snap/certbot/4183/bin/certbot", line 5, in
from certbot.main import main
File "/snap/certbot/4183/lib/python3.12/site-packages/certbot/main.py", line 6, in
from certbot._internal import main as internal_main
File "/snap/certbot/4183/lib/python3.12/site-packages/certbot/_internal/main.py", line 20, in
import josepy as jose
File "/snap/certbot/4183/lib/python3.12/site-packages/josepy/init.py", line 40, in
from josepy.json_util import (
File "/snap/certbot/4183/lib/python3.12/site-packages/josepy/json_util.py", line 24, in
from OpenSSL import crypto
File "/snap/certbot/4183/lib/python3.12/site-packages/OpenSSL/init.py", line 8, in
from OpenSSL import SSL, crypto
File "/snap/certbot/4183/lib/python3.12/site-packages/OpenSSL/SSL.py", line 11, in
from OpenSSL._util import (
File "/snap/certbot/4183/lib/python3.12/site-packages/OpenSSL/_util.py", line 6, in
from cryptography.hazmat.bindings.openssl.binding import Binding
File "/snap/certbot/4183/lib/python3.12/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in
from cryptography.exceptions import InternalError
File "/snap/certbot/4183/lib/python3.12/site-packages/cryptography/exceptions.py", line 9, in
from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
RuntimeError: OpenSSL 3.0's legacy provider failed to load. This is a fatal error by default, but cryptography supports running without legacy algorithms by setting the environment variable CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not expect this error, you have likely made a mistake with your OpenSSL configuration.

My web server is (include version):
nginx 1.18.0 (but not relevant)

The operating system my web server runs on is (include version):

debian 12 (Raspberry Pi Version)

My hosting provider, if applicable, is:
None

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no control panel.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
Can't tell as crash stops that output NOTE recently installed from snap.
snap install --classic certbot (after I removed it).

This raspberry pi is a mail server and the certificate is used to enable my clients within my home connect to the mail server. the dns within the home points mail.chandlerfamily.org.ok to the local network ip address of the raspberry pi. I normally manually change port forwarding of port 80 on my router temporarily, run certbot renew; and then change it back (it normally points to an internal synology nas running both internal and external web sites and this device also regularly renews certificates) just before the certificate expires. I came to just try and find when that was due today and found certbot completely failing to even start.

I'm not sure what to do next

2

Wow "... their last post was 9 years ago."

Welcome back :slight_smile:

I have never seen this error so not sure what to suggest. There is an issue with Certbot v3.0 and a crypto package and maybe this openssl problem is another similar issue.

Even though you can't run certbot --version you said you use snap install. Can you check the version with
sudo snap list | grep -i certbot

For the crypto package problems people have reverted to the prior. Or, for fresh snap installs have instructed snap to install a specific version. You might try either of these. If that works-around the problem you might be better off posting this at the EFF's github for Certbot (link here). The devs will likely need to get involved.

For reverting and re-install certbot snap see this github post and the following ones

2 Likes
3

sudo snap list | grep -i certbot
gives

certbot 3.0.0 4183 latest/stable certbot-eff** classic

1 Like
4

Oops, I should have had you do sudo snap list --all | grep -i certbot

But, that would only help determine whether you could "revert" or would need to install a different version. If you have been using snap certbot for a while you probably have version 2.11.0 (3834) available to revert to.

Did you try that as described in that github thread?

1 Like
5

same output

I didn't try reverting yet. It looks like activity is happening.

This issue seems to closely match my experience, although its on ubuntu whilst Im on raspbian

6

I'm going to hold on for a few days, since my current certificate doesn't expire until 15th Jan and hopefully this mess will get cleared up by then

1 Like
7

It is also a different package so if reverting to 2.11 resolves it you should post a new issue on the EFF github for your error message. Your message specifically says openssl which might be a different packaging issue.

We can only hope :slight_smile: Personally I would post an issue at the github but your call.

2 Likes
8

Cerbot update just came out to fix the crypto deprecation warning: Certbot 3.0.1 Release

Hopefully that resolves your openssl issue too

3 Likes