github CI blocked by the Ubuntu CI with an SSL error

[gpshead]

BPO	43382
Nosy	@nascheme, @gpshead, @vstinner, @tiran, @ned-deily, @ambv, @xnox, @pganssle, @brandtbucher, @martonivan
PRs	bpo-43382: Pin test runner to Ubuntu 18 to un-break CI (for now) #24715

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2021-03-18.08:32:27.271>
created_at = <Date 2021-03-03.04:29:04.400>
labels = ['3.7', '3.8', '3.9', 'release-blocker', 'build', 'tests', 'expert-SSL', 'type-bug', '3.10']
title = 'github CI blocked by the Ubuntu CI with an SSL error'
updated_at = <Date 2021-03-18.08:32:27.270>
user = 'https://github.com/gpshead'

bugs.python.org fields:

activity = <Date 2021-03-18.08:32:27.270>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2021-03-18.08:32:27.271>
closer = 'christian.heimes'
components = ['Build', 'Tests', 'SSL']
creation = <Date 2021-03-03.04:29:04.400>
creator = 'gregory.p.smith'
dependencies = []
files = []
hgrepos = []
issue_num = 43382
keywords = ['patch']
message_count = 21.0
messages = ['387998', '388000', '388001', '388002', '388004', '388006', '388007', '388009', '388010', '388011', '388019', '388031', '388035', '388043', '388045', '388047', '388048', '388052', '388055', '388060', '388999']
nosy_count = 10.0
nosy_names = ['nascheme', 'gregory.p.smith', 'vstinner', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'xnox', 'p-ganssle', 'brandtbucher', 'martonivan']
pr_nums = ['24715']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue43382'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[gpshead]

https://github.com/python/cpython/pull/20442/checks?check_run_id=2018900756

ssl.SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1122)
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1122)
ssl.SSLError: [SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:1122)
ssl.SSLError: [SSL] internal error (_ssl.c:1122)
ssl.SSLError: [SSL] called a function you should not call (_ssl.c:1122)
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:1122)
ssl.SSLError: [SSL: UNEXPECTED_MESSAGE] unexpected message (_ssl.c:1122)
ssl.SSLError: [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1122)
[SSL: NO_PROTOCOLS_AVAILABLE] no protocols available (_ssl.c:1122)

... and so on ...

This CI failure is preventing any PR from being merged.

Do we have a bad test certificate in the tree we need to update?
Or did some Ubuntu CI infrastructure just fall over and start rejecting a certificate it used to accept?

I believe this started around ~20210302T1500 UTC.