Repository: certbot/certbot

Issue:
acme module fails tests with openssl 1.1
On Debian sid, the python-acme module fails to build from source due to test failures.  I suspect this is related to the OpenSSL version bump to 1.1 that happened.

Build log excerpt:
```
======================================================================
ERROR: test_probe_ok (acme.crypto_util_test.SSLSocketAndProbeSNITest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/acme/crypto_util_test.py", line 55, in test_probe_ok
    self.assertEqual(self.cert, self._probe(b'foo'))
  File "/<<PKGBUILDDIR>>/acme/crypto_util_test.py", line 52, in _probe
    name, host='127.0.0.1', port=self.port))
  File "/<<PKGBUILDDIR>>/acme/crypto_util.py", line 145, in probe_sni
    raise errors.Error(error)
Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]

======================================================================
ERROR: test_it (acme.standalone_test.TLSSNI01ServerTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/acme/standalone_test.py", line 52, in test_it
    b'localhost', host=host, port=port, timeout=1)
  File "/<<PKGBUILDDIR>>/acme/crypto_util.py", line 145, in probe_sni
    raise errors.Error(error)
Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]

======================================================================
FAIL: test_it (acme.standalone_test.TestSimpleTLSSNI01Server)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/acme/standalone_test.py", line 146, in test_it
    self.assertTrue(max_attempts > 0, "Timeout!")
AssertionError: Timeout!

----------------------------------------------------------------------
```

Full build log available at: http://aws-logs.debian.net/2016/11/18/python-acme_0.9.3-1_unstable.log
Downstream bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844944


Discussion:

Resolving patch:
diff --git a/acme/acme/crypto_util.py b/acme/acme/crypto_util.py
--- a/acme/acme/crypto_util.py
+++ b/acme/acme/crypto_util.py
@@ -63,6 +63,8 @@ def _pick_certificate_cb(self, connection):
                          server_name)
             return
         new_context = OpenSSL.SSL.Context(self.method)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         new_context.use_privatekey(key)
         new_context.use_certificate(cert)
         connection.set_context(new_context)
@@ -86,6 +88,8 @@ def accept(self):  # pylint: disable=missing-docstring
         sock, addr = self.sock.accept()
 
         context = OpenSSL.SSL.Context(self.method)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         context.set_tlsext_servername_callback(self._pick_certificate_cb)
 
         ssl_sock = self.FakeConnection(OpenSSL.SSL.Connection(context, sock))


Test patch:
diff --git a/acme/acme/crypto_util_test.py b/acme/acme/crypto_util_test.py
--- a/acme/acme/crypto_util_test.py
+++ b/acme/acme/crypto_util_test.py
@@ -19,8 +19,8 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
     """Tests for acme.crypto_util.SSLSocket/probe_sni."""
 
     def setUp(self):
-        self.cert = test_util.load_comparable_cert('cert.pem')
-        key = test_util.load_pyopenssl_private_key('rsa512_key.pem')
+        self.cert = test_util.load_comparable_cert('rsa2048_cert.pem')
+        key = test_util.load_pyopenssl_private_key('rsa2048_key.pem')
         # pylint: disable=protected-access
         certs = {b'foo': (key, self.cert.wrapped)}
 
diff --git a/acme/acme/standalone_test.py b/acme/acme/standalone_test.py
--- a/acme/acme/standalone_test.py
+++ b/acme/acme/standalone_test.py
@@ -33,8 +33,8 @@ class TLSSNI01ServerTest(unittest.TestCase):
 
     def setUp(self):
         self.certs = {b'localhost': (
-            test_util.load_pyopenssl_private_key('rsa512_key.pem'),
-            test_util.load_cert('cert.pem'),
+            test_util.load_pyopenssl_private_key('rsa2048_key.pem'),
+            test_util.load_cert('rsa2048_cert.pem'),
         )}
         from acme.standalone import TLSSNI01Server
         self.server = TLSSNI01Server(("", 0), certs=self.certs)
@@ -114,8 +114,9 @@ def setUp(self):
         self.test_cwd = tempfile.mkdtemp()
         localhost_dir = os.path.join(self.test_cwd, 'localhost')
         os.makedirs(localhost_dir)
-        shutil.copy(test_util.vector_path('cert.pem'), localhost_dir)
-        shutil.copy(test_util.vector_path('rsa512_key.pem'),
+        shutil.copy(test_util.vector_path('rsa2048_cert.pem'),
+                    os.path.join(localhost_dir, 'cert.pem'))
+        shutil.copy(test_util.vector_path('rsa2048_key.pem'),
                     os.path.join(localhost_dir, 'key.pem'))
 
         from acme.standalone import simple_tls_sni_01_server
@@ -147,7 +148,8 @@ def test_it(self):
                 time.sleep(1)  # wait until thread starts
             else:
                 self.assertEqual(jose.ComparableX509(cert),
-                                 test_util.load_comparable_cert('cert.pem'))
+                                 test_util.load_comparable_cert(
+                                     'rsa2048_cert.pem'))
                 break