Building with OpenSSL-4.0.0-alpha1 fails with

[heitbaum]

Bug report

Bug description:

Build fails with the following errors.

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_1_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: TLSv1_2_method

[ERROR] _ssl failed to import:/build/Python3-3.14.3/.x86_64-linux-gnu/build/lib.linux-x86_64-3.14/_ssl.cpython-314-x86_64-linux-gnu.so: undefined symbol: SSLv3_method

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

• gh-146207: Add support for OpenSSL 4.0.0 alpha1 #146217
• [3.14] gh-146207: Add support for OpenSSL 4.0.0 alpha1 (GH-146217) #146403
• [3.13] gh-146207: Add support for OpenSSL 4.0.0 alpha1 (GH-146217) #146404

[vstinner]

Hi,

It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2eb31229a9b..829b0598d5d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
 #error Unsupported OpenSSL version
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+#  define OPENSSL_NO_SSL3
+#  define OPENSSL_NO_TLS1
+#  define OPENSSL_NO_TLS1_1
+#  define OPENSSL_NO_TLS1_2
+#endif
+
 /* OpenSSL API 1.1.0+ does not include version methods */
 #ifndef OPENSSL_NO_SSL3_METHOD
 extern const SSL_METHOD *SSLv3_method(void);
@@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
     ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
     ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
     ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
+#ifndef OPENSSL_NO_TLS1
     ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
+#endif
+#ifndef OPENSSL_NO_TLS1_1
     ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
+#endif
+#ifndef OPENSSL_NO_TLS1_2
     ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
+#endif
 
 #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
 

[vstinner]

cc @picnixz

[heitbaum]

Hi,

It seems like OpenSSL 4.0 removed legacy SSL and TLS protocols. Can you please try this patch?

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 2eb31229a9b..829b0598d5d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -164,6 +164,13 @@ static void _PySSLFixErrno(void) {
#error Unsupported OpenSSL version
#endif

+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+# define OPENSSL_NO_SSL3
+# define OPENSSL_NO_TLS1
+# define OPENSSL_NO_TLS1_1
+# define OPENSSL_NO_TLS1_2
+#endif
+
/* OpenSSL API 1.1.0+ does not include version methods */
#ifndef OPENSSL_NO_SSL3_METHOD
extern const SSL_METHOD *SSLv3_method(void);
@@ -6967,9 +6974,15 @@ sslmodule_init_constants(PyObject *m)
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
+#ifndef OPENSSL_NO_TLS1
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
+#endif
+#ifndef OPENSSL_NO_TLS1_1
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
+#endif
+#ifndef OPENSSL_NO_TLS1_2
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
+#endif

#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

[vstinner]

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

[heitbaum]

I can confirm that this patch allows Python3.14.3 to compile against OpenSSL-4.0.0alpha1

Ok cool. Would you mind to now test #146217? Apply the change to Python, build Python and run test_ssl (./python -m test -v test_ssl). Does test_ssl pass on OpenSSL 4.0.0 alpha1 with my change?

Tested successfully - as attached - needed a minor change to backport the tests to 3.14.3

test.log

--- Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:33.274279599 +0000
+++ Python3-3.14.3/Lib/test/test_ssl.py 2026-03-20 22:15:04.786740174 +0000
@@ -1087,7 +1087,7 @@
         ctx.maximum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
         self.assertIn(
             ctx.maximum_version,
-            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.SSLv3}
+            {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.TLSv1_2, ssl.TLSVersion.TLSv1_3, ssl.TLSVersion.SSLv3}
         )

         ctx.minimum_version = ssl.TLSVersion.MAXIMUM_SUPPORTED