diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 6cd3a5e6d9b..36ed3aa9124 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -142,7 +142,7 @@ class BasicSocketTests(unittest.TestCase): # Error checking can happen at instantiation or when connecting with self.assertRaisesRegexp(ssl.SSLError, "No cipher can be selected"): s = ssl.wrap_socket(socket.socket(socket.AF_INET), - cert_reqs=ssl.CERT_NONE, ciphers="^$:,;?*'dorothyx") + cert_reqs=ssl.CERT_NONE, ciphers="xyzzy") s.connect(remote) @support.cpython_only @@ -186,7 +186,7 @@ class ContextTests(unittest.TestCase): ctx.set_ciphers("ALL") ctx.set_ciphers("DEFAULT") with self.assertRaisesRegexp(ssl.SSLError, "No cipher can be selected"): - ctx.set_ciphers("^$:,;?*'dorothyx") + ctx.set_ciphers("xyzzy") def test_verify(self): ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 96d79b31333..39fec7b6697 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1462,6 +1462,10 @@ set_ciphers(PySSLContext *self, PyObject *args) return NULL; ret = SSL_CTX_set_cipher_list(self->ctx, cipherlist); if (ret == 0) { + /* Clearing the error queue is necessary on some OpenSSL versions, + otherwise the error will be reported again when another SSL call + is done. */ + ERR_clear_error(); PyErr_SetString(PySSLErrorObject, "No cipher can be selected."); return NULL;