[issue38275] test_ssl: skip tests for disabled TLS/SSL versions

[Christian Heimes]

New submission from Christian Heimes <lists at cheimes.de>:

test_ssl has some checks for TLS/SSL versions that are not available or disabled during compile-time of Python and OpenSSL. It's missing run-time checks and checks for TLS 1.0 and 1.1. Several test scenarios assume that TLS 1.0 and 1.1 are always available and properly working. These tests fail when e.g. TLS 1.0 is disabled.

Further more compile-time checks for ssl.HAS_TLSv1 or ssl.PROTOCOL_TLSv1 are not sufficient. OpenSSL 1.1.0+ got more flexible. TLS/SSL versions can be disabled at runtime with a crypto policy. Recent Debian, Fedora, and RHEL 8 systems have TLS 1.0 and 1.1 disabled by default.

----------
assignee: christian.heimes
components: Tests
messages: 353189
nosy: christian.heimes
priority: normal
severity: normal
status: open
title: test_ssl: skip tests for disabled TLS/SSL versions
type: resource usage
versions: Python 3.7, Python 3.8, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue38275>
_______________________________________