openssl 1.0.1 client hello connection failure about facebook-sdk

[martey]

Could you provide more details about your environment and the failures you are seeing? I have read the blog post you linked to, but it is not clear how it translates to Python.

Even if this is an external issue, it would make sense to make changes if there is an easy workaround.

[aburgel]

i'm running python 2.7.2 with openssl 1.0.1

i think its actually an issue with openssl not correctly detecting the ssl version on the other end. if i run other versions of python that are compiled with earlier versions of openssl, then it works.

i'm not sure how wide spread this is because most OSes seem to use earlier versions of openssl.

the workaround is to specify the ssl version when opening a new http connection.

[martey]

Doing some research, I was able to find a report of the bug in Debian, which led to a ArchLinux forum thread and a bug report on OpenSSL's request tracker.

All indications suggest that openssl (and downstream packages) will eventually be patched to fix this. If you have code for your workaround that you would like to submit as a patch or pull request, I can test it (to make sure that it will not break on machines running earlier version of openssl) and incorporate it so other people will not run into this issue in the meantime.

[aburgel]

i don't have a patch, but there's a work around mentioned in this python bug. its not the same bug but i think addresses the same issue.

[martey]

Based on my reading of openssl's CHANGES file, this looks like it was fixed in openssl 1.0.1a. In my testing (with version 1.0.1b), I was able to get it to work.

@aburgel, could you try upgrading to the most recent version and letting me know if it is fixed? I would prefer not to add a custom HTTPS opener to the library if possible.

[aburgel]

i just tested with 1.0.1c, and everything is now working.

[martey]

Since this is no longer an issue with current or stable versions of openssl, I am closing this issue.