upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-06-04 14:26:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix openssl env vars (#10223)

Browse source 
this should fix https://github.com/certbot/certbot/issues/10190

i unfortunately wasn't able to reproduce the nginx problem, but i did
audit all subprocess calls in certbot and all of its plugins and
confirmed that they use this `env_no_snap_for_external_calls` function.
with `OPENSSL_MODULES` no longer pointing inside the snap, this problem
should go away

i also cleared `OPENSSL_FORCE_FIPS_MODE` because of the report
[here](https://community.letsencrypt.org/t/certbot-snap-error-while-renewing-openssl-init-ssl/232145/16)
This commit is contained in:
Brad Warren 2025-03-06 13:21:33 -08:00 committed by GitHub
parent a43fdedd12
commit 48ffe02ce3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
certbot/CHANGELOG.md
View file

@ -18,7 +18,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
### Fixed
*
* Fixed a bug introduced in Certbot 3.1.0 where OpenSSL environment variables
needed in our snap configuration were persisted in calls to external programs
like nginx which could cause them to fail to load OpenSSL.
More details about these changes can be found on our GitHub repo.

6
certbot/certbot/util.py
View file

@ -165,6 +165,12 @@ def env_no_snap_for_external_calls() -> Dict[str, str]:
# Avoid accidentally modifying env
if 'SNAP' not in env or 'CERTBOT_SNAPPED' not in env:
return env
# These environment variables being set when running external programs can cause issues if these
# programs also use OpenSSL. See https://github.com/certbot/certbot/issues/10190.
env.pop('OPENSSL_FORCE_FIPS_MODE', None)
env.pop('OPENSSL_MODULES', None)
for path_name in ('PATH', 'LD_LIBRARY_PATH'):
if path_name in env:
env[path_name] = ':'.join(x for x in env[path_name].split(':') if env['SNAP'] not in x)