Repository: certbot/certbot

Issue:
Upgrade to cryptography 2.8 in certbot-auto
As described at https://github.com/pyca/cryptography/issues/4923, cryptography is dropping support for OpenSSL 1.0.1. The major distros affected by this are CentOS 6, Debian 8, and Ubuntu 14.04.

For CentOS 6 and Debian 8, they are supported by certbot-auto and the OSes don't reach their full end-of-life until next year. Most certbot-auto users are unaffected by this as cryptography ships precompiled wheels with their own copy of OpenSSL for 64 bit x86 systems. Users on other architectures have to compile cryptography against their local copy of OpenSSL at install time.

I pulled some [stats from PyPI](https://gist.github.com/bmw/6046db32fcfd1e7e4f89072cbcb627b1) and not many users are affected. I think giving them a simple heads up would be nice though so I propose upgrading the version of cryptography in certbot-auto to 2.8 when it is released. This will print messages like this on every run:
```
CryptographyDeprecationWarning: OpenSSL version 1.0.1 is no longer supported by the OpenSSL project, please upgrade. The next version of cryptography will drop support for it.
```
The correct solution to remove this warning is to upgrade their system, but they can also silence the warning through the [PYTHONWARNINGS environment variable](https://docs.python.org/2.7/using/cmdline.html#envvar-PYTHONWARNINGS) or by downgrading certbot-auto and then using `--no-self-upgrade`.

Ubuntu 14.04 is only receiving updates through [Ubuntu's ESM program](https://ubuntu.com/esm) and I think we should drop support for the platform. https://github.com/certbot/certbot/issues/7183 and https://github.com/certbot/website/pull/427 track this work.

EDIT: As pointed out by @alvinhochun, a similar message is already being printed, however, this upgrade will make the error message say support will be dropped in the next version of cryptography rather than an unspecified future version.


Discussion:
Support for Trusty has been removed. ESM is security-fixes only for environments  with difficult-to-solve migration blockers, and we shouldn't expect any support or updates useful to maintaining support for Certbot on this platform.
I started receiving the above CryptographyDeprecationWarning message from an i686 CentOS 6 box since 4/9. But as I understand from the OP, this warning should only appear when the cryptography dependency in certbot-auto is updated to 2.8 and it hasn't yet happened, so why am I getting it already?

(Edit: I made a post on https://community.letsencrypt.org/t/getting-openssl-1-0-1-deprecation-warning-on-centos-6-from-certbot-auto/101412)
@alvinhochun, as you've noticed, this change described in my initial post hasn't happened yet so what you're describing is a different issue. I'd encourage you to read the text in the warning and if you need additional help, posting to https://community.letsencrypt.org.
FYI, we've merged the change into cryptography `master` (what will become 2.9) to drop 1.0.1 support.
Sounds good. Thanks for the heads up.
For the historical record, the 2.9 release has an env for for opting-out that will be removed in 3.0: https://cryptography.io/en/latest/faq/#importing-cryptography-causes-a-runtimeerror-about-openssl-1-0-1

Resolving patch:
diff --git a/letsencrypt-auto-source/rebuild_dependencies.py b/letsencrypt-auto-source/rebuild_dependencies.py
--- a/letsencrypt-auto-source/rebuild_dependencies.py
+++ b/letsencrypt-auto-source/rebuild_dependencies.py
@@ -46,9 +46,12 @@
     # certbot-auto failures on Python 3.6+ which enum34 doesn't support. See #5456.
     # TODO: hashin seems to overwrite environment markers in dependencies. This needs to be fixed.
     'enum34': '1.1.6 ; python_version < \'3.4\'',
-    # Newer versions of requests dropped support for python 3.4. Once Certbot does as well,
-    # we should unpin the dependency.
+    # Newer versions of the packages below dropped support for python 3.4. Once
+    # Certbot does as well, we should unpin these dependencies.
     'requests': '2.21.0',
+    'ConfigArgParse': '0.14.0',
+    'zope.hookable': '4.2.0',
+    'zope.interface': '4.6.0',
 }
 
 


Test patch: