[Python-Dev] LibreSSL support
christian at python.org
Thu Jan 18 10:32:16 EST 2018
On 2018-01-16 21:17, Christian Heimes wrote:
> FYI, master on Travis CI now builds and uses OpenSSL 1.1.0g . I have
> created a daily cronjob to populate Travis' cache with OpenSSL builds.
> Until the cache is filled, Linux CI will take an extra 5 minute.
I have messed up my initial research. :( When I was checking LibreSSL
and OpenSSL for features, I draw a wrong conclusion. LibreSSL is *not*
OpenSSL 1.0.2 compatible. It only implements some of the required
features from 1.0.2 (e.g. X509_check_hostname) but not
X509_VERIFY_PARAM_set1_host() is required to perform hostname
verification during the TLS handshake. Without the function, I'm unable
to fix Python's hostname matching code . LibreSSL upstream knows
about the issue since 2016 . I have opened another bug report .
We have two options until LibreSSL has addressed the issue:
1) Make the SSL module more secure, simpler and standard conform
2) Support LibreSSL
I started a vote on Twitter . So far most people prefer security.
More information about the Python-Dev