Skip to content

Conversation

@jatalahd
Copy link
Contributor

@jatalahd jatalahd commented Nov 16, 2025

If pyopenssl adapter is used with password protected private key and the manual entry option was not given, only a fail due to invalid password. The password callback used to also be triggered in the case where the private_key_password was None.

What kind of change does this PR introduce?

  • [ x] 🐞 bug fix
  • 🐣 feature
  • 📋 docs update
  • 📋 tests/coverage improvement
  • 📋 refactoring
  • 💥 other

📋 What is the related issue number (starting with #)

Resolves #

What is the current behavior? (You can also link to an open issue here)

Manual prompt to enter private key password is not given in server startup
in the case where private_key_password = None. Functionality conflicts with
documentation and with builtin adapter

What is the new behavior (if this is a feature change)?

With this fix the functionality is matching the documentation
and both ssl adapters work in similar fashion.

📋 Other information:

📋 Contribution checklist:

(If you're a first-timer, check out
this guide on making great pull requests)

  • [ x] I wrote descriptive pull request text above
  • [ x] I think the code is well written
  • [ x] I wrote good commit messages
  • [ x] I have squashed related commits together after
    the changes have been approved
  • Unit tests for the changes exist
  • Integration tests for the changes exist (if applicable)
  • [ x] I used the same coding conventions as the rest of the project
  • [ x] The new code doesn't generate linter offenses
  • [ x] Documentation reflects the changes
  • [ x] The PR relates to only one subject with a clear title
    and description in grammatically correct, complete sentences

- If pyopenssl adapter was used with password protected private key,
  the manual entry option was not given, only a fail due to
  invalid password. The password callback was triggered also
  in the case where the private_key_password was None.
@codecov
Copy link

codecov bot commented Nov 16, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.53%. Comparing base (56de07c) to head (339ca88).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #798   +/-   ##
=======================================
  Coverage   77.52%   77.53%           
=======================================
  Files          41       41           
  Lines        4672     4673    +1     
  Branches      544      545    +1     
=======================================
+ Hits         3622     3623    +1     
  Misses        908      908           
  Partials      142      142           

@webknjaz
Copy link
Member

@jatalahd may I ask why does your checklist and up having * [ x] instead of * [x] in markdown?

Comment on lines +370 to +371
if self.private_key_password is not None:
c.set_passwd_cb(self._password_callback, self.private_key_password)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was #752 (comment) incorrect? Why? How?

Can this be tested? Could you add a change log fragment?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why don't we have _password_callback() raise RuntimeError if password is None? If we don't set the callback, passing an encrypted private key will probably traceback in some weird place. It seems more reasonable to have our own error reporting for this case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants