Did OpenSSL 3.0 break Certbot?

Before reading @Osiris' post about the existing bug report , i was troubleshooting this from a Python perspective:

I don't think any of that would matter. That error gets triggered when Cryptography checks for FIPS support, and the underlying bindings don't have the right symbols.

Stuff like this usually means your bindings or core library are too old and don't meet the minimum version requirements. Most of the things you've posted suggest to me that you should be meeting these requirements. To be safe, I double checked the OpenSSL source - and they have had this for years in the various branches, so I am pretty sure it's not an issue with OpenSSL itself.

Looking at the history of Cryptography - in April of 2023 they migrated the fips detection to Rust.

It is possible the existing bug that Osiris found does not affect earlier releases. It very well might be affected in the same exact way - but the checks are completely different (see Move is_fips logic to Rust by alex · Pull Request #8822 · pyca/cryptography · GitHub) so I would not be surprised if you are able to use a version of Cryptography prior to that date.

So... I would try the following based on cryptography · PyPI releases as a potential stopgap solution:

pip install "cryptography==40.0.2"
3 Likes