Skip to content

PYTHON-3015 Document cipher mismatch issues #791

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 16, 2021
Merged

PYTHON-3015 Document cipher mismatch issues #791

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions doc/examples/tls.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,3 +213,21 @@ revocation checking failed::
[('SSL routines', 'tls_process_initial_server_flight', 'invalid status response')]

See :ref:`OCSP` for more details.

Python 3.10+ incompatibilities with TLS/SSL on MongoDB <= 4.0
Copy link
Member

@ShaneHarvey ShaneHarvey Nov 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One question, you mentioned that this error happens on the latest releases of 3.7+ on some platforms too. Is that still true? Should we mention that problem?
Copy link
Member Author

@behackett behackett Nov 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect that is a Gentoo Linux specific problem. They seem to have backported the cipher changes to older versions of Python. I don't think it's worth getting into in this document.
.............................................................

Note that `changes made to the ssl module in Python 3.10+
<https://docs.python.org/3/whatsnew/3.10.html#ssl>`_ may cause incompatibilities
with MongoDB <= 4.0. The following are some example errors that may occur with this
combination::

SSL handshake failed: localhost:27017: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:997)
SSL handshake failed: localhost:27017: EOF occurred in violation of protocol (_ssl.c:997)

The MongoDB server logs may show the following error::

2021-06-30T21:22:44.917+0100 E NETWORK [conn16] SSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher

To resolve this issue, use Python <=3.10, upgrade to MongoDB 4.2+, or install
pymongo with the :ref:`OCSP` extra which relies on PyOpenSSL.