Tests fail when run under Ubuntu 20.04 due to global security minimums

[alex]

    def test_set_proto_version(self):
        server_context = Context(TLS_METHOD)
        server_context.use_certificate(
            load_certificate(FILETYPE_PEM, root_cert_pem)
        )
        server_context.use_privatekey(
            load_privatekey(FILETYPE_PEM, root_key_pem)
        )
        server_context.set_min_proto_version(TLS1_2_VERSION)
    
        client_context = Context(TLS_METHOD)
        client_context.set_max_proto_version(TLS1_1_VERSION)
    
        with pytest.raises(Error, match="unsupported protocol"):
>           self._handshake_test(server_context, client_context)
E           AssertionError: Regex pattern 'unsupported protocol' does not match "[('SSL routines', 'tls_construct_client_hello', 'no protocols available')]".

This is because Ubuntu 20.04 appears to have TLS 1.2 as the minimum by default.

[tiran]

Ubuntu 20.04 and newer have patched OpenSSL and changed the meaning of security policy level 2. Ustream OpenSSL 1.1.1 allows TLS 1.0 and 1.1 in security level 2. Ubuntu blocks both protocols in security level 2. You have to lower security level to 1.

CPython fix: python/cpython#24915

Context:

• https://bugs.python.org/issue41561#msg389003
• https://bugs.python.org/issue43382
• https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
• https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625