I'm using this ticket as an epos to track commits and required changes for OpenSSL 1.1.1 and TLS 1.3. Fixes need to be backported to 2.7 and 3.6 to 3.8. We might have to consider backports to 3.4 and 3.5, too.

If all goes to plan, OpenSSL 1.1.1 final is scheduled for 8th May 2018, https://www.openssl.org/policies/releasestrat.html . It will contain support for TLS 1.3. Python should either support TLS 1.3 by then or disable TLS 1.3 by default.

Fixes:

* #20995 added TLS 1.3 cipher suite support
* #29136 added OP_NO_TLSv1_3
* #30622 fixes NPN guard for OpenSSL 1.1.1

Issues:

* A new option OP_ENABLE_MIDDLEBOX_COMPAT is enabled by default. We need to expose the flag to make test pass.
* TLS 1.3 has changed session handling. The current session code cannot handle TLS 1.3 session resumption.
* Threaded echo server and asynchat based tests are failing with TLS 1.3. I haven't analyzed the issue properly. It looks like the server thread dies when a handshake error occurs.

Ned, Benjamin

OpenSSL 1.1.1 is scheduled to be released just before 3.7.0rc1 will come out. I'd rather address as many issues now instead of adding last minute patches to the release candidate.

Once OpenSSL 1.1.1 is out and Python 3.7 supports it, we can discuss backports. 3.6 and 2.7 are going to need fixing, too.

Christian, I'm not sure how this issue now differs from Issue33618 (and whether it can be closed as a duplicate) but, with the delay in OpenSSL 1.1.1 and as discussed over there, full 1.1.1 support will have to wait for 3.7.1 et al so I'm removing the "deferred blocker" status.

3.7 and 3.8 support OpenSSL 1.1.1-pre7-dev. For 3.6 and 2.7 I have to backport some test fixes and documentation.

I prefer to wait until both TLS 1.3 and OpenSSL 1.1.1 have been finalized. Once 1.1.1 is out, I'll fix the outstanding issues on master and then backport all fixes to 3.6 / 2.7.

Note that Fedora 29 updated openssl from 1.1.0h to 1.1.1-0.pre8 and Python 3.7 tests are failing. Not 100% sure it's related, but full report at: 

https://bugzilla.redhat.com/show_bug.cgi?id=1609291

Yes test_poplib and test_ftplib on fedora rawhide when run against openssl 1.1.1 pre8. Haven't tried the pr7, but assuming that the tests were fine before here is the list of changes between pre7 and pre8:

https://github.com/openssl/openssl/compare/OpenSSL_1_1_1-pre7...OpenSSL_1_1_1-pre8

New changeset 2a4ee8aa01d61b6a9c8e9c65c211e61bdb471826 by Christian Heimes in branch '3.6':
bpo-32947: Fixes for TLS 1.3 and OpenSSL 1.1.1 (GH-8761)
https://github.com/python/cpython/commit/2a4ee8aa01d61b6a9c8e9c65c211e61bdb471826

This are the errors I'm currently getting testing with the pre9 verion in Debian:
https://ci.debian.net/data/autopkgtest/testing/amd64/p/python2.7/865936/log.gz
https://ci.debian.net/data/autopkgtest/testing/amd64/p/python3.6/865937/log.gz
https://ci.debian.net/data/autopkgtest/testing/amd64/p/python3.7/865938/log.gz

Kurt, can you try again with a current git checkout from master? I fixed a couple of issues lately. CPython master passes all tests with vanilla OpenSSL 1.1.1-pre9. Does Debian change some default settings?

This are automated tests for the packages in Debian. I uploaded the pre9 version to unstable, and as a result of that all reverse dependencies got tested. I don't have any experience with python myself.

Anyway, the openssl.cnf in Debian contains:
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2

So you might want to override that during the test suite by calling SSL_CTX_set_min_proto_version(ctx, 0).

Christian,

Do you have any update on this? Any idea when we can expect relased python versions that work with OpenSSL 1.1.1?

Soonish, I'm still working on post handshake auth.

Kurt, see #34670 for PHA for server and client side.

Do you have any idea when the next release will be? I think python is currently our biggest blocker for getting OpenSSL 1.1.1 in Debian testing.

The release candidates came out a couple of days ago.

On Fedora 29 with OpenSSL 1.1.1 FIPS  11 Sep 2018, test_connect_cadata() of test_ssl fails randomly:

---
$ ./python -m test -u all -F -m test_connect_cadata test_ssl 
Run tests sequentially
0:00:00 load avg: 0.43 [  1] test_ssl
test test_ssl failed -- Traceback (most recent call last):
  File "/home/vstinner/prog/python/3.6/Lib/test/test_ssl.py", line 1642, in test_connect_cadata
    s.connect(self.server_addr)
  File "/home/vstinner/prog/python/3.6/Lib/ssl.py", line 1109, in connect
    self._real_connect(addr, False)
  File "/home/vstinner/prog/python/3.6/Lib/ssl.py", line 1100, in _real_connect
    self.do_handshake()
  File "/home/vstinner/prog/python/3.6/Lib/ssl.py", line 1077, in do_handshake
    self._sslobj.do_handshake()
  File "/home/vstinner/prog/python/3.6/Lib/ssl.py", line 689, in do_handshake
    self._sslobj.do_handshake()
ConnectionResetError: [Errno 104] Connection reset by peer

test_ssl failed

== Tests result: FAILURE ==

1 test failed:
    test_ssl

Total duration: 131 ms
Tests result: FAILURE
---

This bug has been fixed in master by commit 529525fb5a8fd9b96ab4021311a598c77588b918. It was partially backported in 3.6 with commit 2a4ee8aa01d61b6a9c8e9c65c211e61bdb471826, but the backport is incomplete.

I wrote PR 11612 to backport remaining fixes.

New changeset 2149a9ad7a9d39d7d680ec0fb602042c91057484 by Victor Stinner (stratakis) in branch '2.7':
[2.7] bpo-32947: Fixes for TLS 1.3 and OpenSSL 1.1.1 (GH-8761) (GH-11876)
https://github.com/python/cpython/commit/2149a9ad7a9d39d7d680ec0fb602042c91057484

Was using OpenSSL to verify hostnames intentionally not backported?

Yes, the feature requires OpenSSL 1.0.2 and a more recent version of LibreSSL. 2.7 and 3.6 branches still target platforms with ancient versions of OpenSSL (e.g. Ubuntu 14.04 has 1.0.1f + patches). People were complain A LOT, because there were not able to install Python 3.7 on TravisCI. Like really a lot, alot.

I propose to close this bug as fixed in 3.7+

New changeset 3dbc43f63c7e056b80d6e28f3812125a09555456 by Ned Deily (Victor Stinner) in branch '3.6':
bpo-32947: test_ssl fixes for TLS 1.3 and OpenSSL 1.1.1 (GH-11612)
https://github.com/python/cpython/commit/3dbc43f63c7e056b80d6e28f3812125a09555456

I don't have a strong opinion about backporting to 3.6.  With OpenSSL 1.0.2 official support ending at the end of 2019 and 3.6.z retired towards the ned of 2021, there would be a 2-year window where 3.6 is still in security-fix-only status.  But, if we don't do the backport now, we could always choose to backport it later if the need arises.