self-signed.pythontest.net TLS certificate key is too weak

[gpshead]

BPO	36816
Nosy	@gpshead, @larryhastings, @ned-deily, @aixtools, @yan12125, @ewdurbin, @miss-islington
PRs	bpo-35925: Skip SSL tests that fail due to weak external certs. #13124 bpo-36816: Update the self-signed.pythontest.net cert #13192 [3.7] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) #13197 [3.6] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) #13198 [2.7] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) #13199 [3.5] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192) #13200

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/gpshead'
closed_at = <Date 2019-09-09.09:39:04.028>
created_at = <Date 2019-05-06.18:05:40.595>
labels = ['3.7', 'expert-SSL', '3.8', 'type-bug', 'tests']
title = 'self-signed.pythontest.net TLS certificate key is too weak'
updated_at = <Date 2019-09-09.09:39:04.027>
user = 'https://github.com/gpshead'

bugs.python.org fields:

activity = <Date 2019-09-09.09:39:04.027>
actor = 'gregory.p.smith'
assignee = 'gregory.p.smith'
closed = True
closed_date = <Date 2019-09-09.09:39:04.028>
closer = 'gregory.p.smith'
components = ['Tests', 'SSL']
creation = <Date 2019-05-06.18:05:40.595>
creator = 'gregory.p.smith'
dependencies = []
files = []
hgrepos = []
issue_num = 36816
keywords = ['patch']
message_count = 15.0
messages = ['341579', '341590', '341843', '341865', '341866', '341908', '341931', '341946', '341950', '342988', '342997', '343020', '343027', '347841', '351382']
nosy_count = 7.0
nosy_names = ['gregory.p.smith', 'larry', 'ned.deily', 'Michael.Felt', 'yan12125', 'EWDurbin', 'miss-islington']
pr_nums = ['13124', '13192', '13197', '13198', '13199', '13200']
priority = 'normal'
resolution = 'remind'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue36816'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

[gpshead]

test_httplib uses self-signed.pythontest.net in it's test_networked_good_cert test.

On modern Linux distros (current Debian testing sid), the certificate it currently uses is rightfully rejected as being too weak:

ERROR: test_networked_good_cert (test.test_httplib.HTTPSTest)
----------------------------------------------------------------------

Traceback (most recent call last):
  File "/home/greg/oss/cpython/Lib/test/test_httplib.py", line 1628, in test_networked_good_cert
    h.request('GET', '/')
  File "/home/greg/oss/cpython/Lib/http/client.py", line 1221, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/home/greg/oss/cpython/Lib/http/client.py", line 1267, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/home/greg/oss/cpython/Lib/http/client.py", line 1216, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/home/greg/oss/cpython/Lib/http/client.py", line 1004, in _send_output
    self.send(msg)
  File "/home/greg/oss/cpython/Lib/http/client.py", line 944, in send
    self.connect()
  File "/home/greg/oss/cpython/Lib/http/client.py", line 1383, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/home/greg/oss/cpython/Lib/ssl.py", line 405, in wrap_socket
    return self.sslsocket_class._create(
  File "/home/greg/oss/cpython/Lib/ssl.py", line 853, in _create
    self.do_handshake()
  File "/home/greg/oss/cpython/Lib/ssl.py", line 1117, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1055)

The TLS certificate on the server needs to be updated to something modern. I _believe_ this can be done by someone with infrastructure access via an update to https://github.com/python/pythontestdotnet/tree/master/tls

Assigning to EWDurbin for triage and redirection to someone else infrastructury if he's not the right person.

How to know if it has been fixed? Monitor the test_networked_good_cert test on any "Debian buster" builtbot(s) such as https://buildbot.python.org/all/#/workers/23 to make sure it is not skipped. (the test _currently_ fails, I am going to have it be _skipped_ on this specific key too small error for the time being to get that stable buildbot green again)

[gpshead]

EWDurbin says I can just open a PR with new certs in the repo and it'll go from there. :)

[gpshead]

Updated cert+key committed to pythontestdotnet. reassigning to EWDurbin to see that they're deployed.

python/pythontestdotnet@2d12141

[ewdurbin]

Cert updated, reassigning back to gregory.p.smith to verify and close this out.