Cannot initialize openssl bindings

[rossburton]

We've built cryptography 36.0.1 against OpenSSL 3.0.1 but get the following error. It's reproducible with a minimal test case:

$ python3 -c "import cryptography.hazmat.backends.openssl"

cryptography.exceptions.InternalError: Unknown OpenSSL error. This error is commonly encountered when another library is not cleaning up the OpenSSL error stack. If you are using cryptography with another library that uses OpenSSL try disabling it before reporting a bug. Otherwise please file an issue at https://github.com/pyca/cryptography/issues with information on how to reproduce this.
([_OpenSSLErrorWithText(code=310378599, lib=37, reason=103, reason_text=b'error:12800067:DSO support routines::could not load the shared library'), _OpenSSLErrorWithText(code=310378599, lib=37, reason=103, reason_text=b'error:12800067:DSO support routines::could not load the shared library'), _OpenSSLErrorWithText(code=126615813, lib=15, reason=786693, reason_text=b'error:078C0105:common libcrypto routines::init fail')])

[alex]

Please provide instructions for reproducing -- we test against OpenSSL 3.0.1 in CI so this is known to work.

[rossburton]

I can give you a full reproducer but you'll spend a while building stuff as we bootstrap rust and gcc. Is there anything obvious I can poke at myself? strace shows it's loading the right libssl.so so that really obvious problem isn't the cause.

[tiran]

OpenSSL 3.0 uses external shared libraries to provide cryptographic primitives. Did you build OpenSSL 3.0 with special flags to disable dynamic loading or are the crypto providers missing?

[alex]

Here's how we build in CI:

• https://github.com/pyca/cryptography/blob/main/.github/workflows/build_openssl.sh#L14-L37
• https://github.com/pyca/cryptography/blob/main/.github/workflows/ci.yml#L86-L123

Has this previously worked on other versions of OpenSSL, or is this a fresh setup?

[rossburton]

Fresh setup, we've just upgraded to 36 from 3.3.2

[rossburton]

Ah, it looks like we're not installing the legacy provider for some reason. That might be a problem.

[tiran]

Ah, it looks like we're not installing the legacy provider for some reason. That might be a problem.

That's it. Cryptography loads the legacy and the default provider. #6809 might change it.

[rossburton]

We have an interesting build environment and it was looking in the wrong place for the providers, so couldn't load the legacy provider.

Thanks for the hint @tiran.