diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 619968585d3..bab14529f8e 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -232,6 +232,26 @@ class NetworkedTests(unittest.TestCase): if test_support.verbose: sys.stdout.write("\nVerified certificate for svn.python.org:443 is\n%s\n" % pem) + def test_algorithms(self): + # Issue #8484: all algorithms should be available when verifying a + # certificate. + # NOTE: https://sha256.tbs-internet.com is another possible test host + remote = ("sha2.hboeck.de", 443) + sha256_cert = os.path.join(os.path.dirname(__file__), "sha256.pem") + s = ssl.wrap_socket(socket.socket(socket.AF_INET), + cert_reqs=ssl.CERT_REQUIRED, + ca_certs=sha256_cert,) + with test_support.transient_internet(): + try: + s.connect(remote) + if test_support.verbose: + sys.stdout.write("\nCipher with %r is %r\n" % + (remote, s.cipher())) + sys.stdout.write("Certificate is:\n%s\n" % + pprint.pformat(s.getpeercert())) + finally: + s.close() + try: import threading diff --git a/Misc/NEWS b/Misc/NEWS index d03a4753588..9f008175b3a 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -20,6 +20,10 @@ Core and Builtins Library ------- +- Issue #8484: Load all ciphers and digest algorithms when initializing + the _ssl extension, such that verification of some SSL certificates + doesn't fail because of an "unknown algorithm". + - Issue #8437: Fix test_gdb failures, patch written by Dave Malcolm - Issue #4814: timeout parameter is now applied also for connections resulting diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 6dad6a6ff1f..4702ecbfe1d 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1603,13 +1603,14 @@ init_ssl(void) /* Init OpenSSL */ SSL_load_error_strings(); + SSL_library_init(); #ifdef WITH_THREAD /* note that this will start threading if not already started */ if (!_setup_ssl_threads()) { return; } #endif - SSLeay_add_ssl_algorithms(); + OpenSSL_add_all_algorithms(); /* Add symbols to module dict */ PySSLErrorObject = PyErr_NewException("ssl.SSLError",