By: Ha Ro user 26 Jul 2020 at 6:36 a.m. CDT

3 Responses
Ha Ro gravatar
Through multiple tests, found that while can use certbot in chroot of Gluu 3.1.6 on Ubuntu 16.04, it breaks due to conflicts with the OpenSSL setup (not able to get it to use OpenSSL1.1.1 required) insite the Gluu chroot in Gluu 3.1.6, 3.1.7, and 3.1.8. Due to looming EOL for Ubunutu 16.04, our ISP stopped supporting VM images for Ubuntu 16.04 a few months ago. We have limpted along with duplicate images, but can spin up anything new with 16.04, so we really need to move to 18.04. However we can't move to Gluu 4.x for a few more months. Strangely when posting this ticket I can't select Gluu version 3.1.8 from the versions pull-down list. Totally fresh install of Gluu 3.1.8, (also tried with 3.1.7 and 3.1.6 with same problem). certbot -d <fqdn> installs working cert for chroot'd apache2 Working, valid non-self-signed, public ssl certs. ``` Instead: This all works okay which works in 3.1.6 (inside chroot): apt-get update apt-get install software-properties-common add-apt-repository universe add-apt-repository ppa:certbot/certbot apt-get update apt-get install certbot python-certbot-apache Here is where it breaks (may have caused the breakage in one of the steps above?) (works in 3.1.6, but breaks in 3.1.8): root@tfndevau1:~# certbot -d tfndevau1.thefantasy.network Traceback (most recent call last): File "/usr/bin/certbot", line 11, in <module> load_entry_point('certbot==0.31.0', 'console_scripts', 'certbot')() File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 480, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2693, in load_entry_point return ep.load() File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2324, in load return self.resolve() File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2330, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) File "/usr/lib/python3/dist-packages/certbot/main.py", line 10, in <module> import josepy as jose File "/usr/lib/python3/dist-packages/josepy/__init__.py", line 44, in <module> from josepy.interfaces import JSONDeSerializable File "/usr/lib/python3/dist-packages/josepy/interfaces.py", line 8, in <module> from josepy import errors, util File "/usr/lib/python3/dist-packages/josepy/util.py", line 4, in <module> import OpenSSL File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module> from OpenSSL import crypto, SSL File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 16, in <module> from OpenSSL._util import ( File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 6, in <module> from cryptography.hazmat.bindings.openssl.binding import Binding File "/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl/binding.py", line 13, in <module> from cryptography.hazmat.bindings._openssl import ffi, lib ImportError: /usr/local/lib/libcrypto.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3/dist-packages/cryptography/hazmat/bindings/_openssl.abi3.so) ``` Any suggestions how to resolve this? Works fine in regular Ubuntu 18.04 of the same server, just not inside the chroot. Thanks!

By Ha Ro user 27 Jul 2020 at 12:01 a.m. CDT

Ha Ro gravatar
Update, while it worked on Gluu 3.1.6 on Ubuntu 16.04, I managed to get Gluu 3.1.6 installed on Ubuntu 18.04, and have the same problem. Not a problem outside of the chroot, just inside the chroot, with ubuntu 18.04, not letting openssl 1.1.1 function.

By Ha Ro user 28 Jul 2020 at 10:55 a.m. CDT

Ha Ro gravatar
Reiterating the steps to replicate: Fresh install of Ubunutu 18.04 Fully update operating system. Reboot. Install Gluu 3.1.6 via apt. Start basic gluu /sbin/gluu-server-3.1.6 start Login to chroot /sbin/gluu-server-3.1.6 login Perform the following steps that work fine on Ubunutu 16.04 with Gluu 3.1.6: apt-get update apt-get install software-properties-common add-apt-repository universe add-apt-repository ppa:certbot/certbot apt-get update apt-get install certbot python-certbot-apache Up to this point, everything seems to work the same on both Ubuntu 16.04/Glluu-3.1.6 chroot, and Ubuntu 18.04/Gluu-3.1.6 chroot. Now, here is where it gets stuck and cannot proceed further, because of conflicting installed OpenSSL 1.1.0 older SSL chat is included in the chroot and I can't figure out how to remove, and so even though desired OpenSSL 1.1.1 is installed, it isn't loading the library dependencies, so can run certbot to create SSL certificates: ``` root@tfndevau1:~# certbot -d tfndevau1.thefantasy.network Traceback (most recent call last): File "/usr/bin/certbot", line 11, in load_entry_point('certbot==0.31.0', 'console_scripts', 'certbot')() File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 480, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2693, in load_entry_point return ep.load() File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2324, in load return self.resolve() File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2330, in resolve module = import(self.module_name, fromlist=['name'], level=0) File "/usr/lib/python3/dist-packages/certbot/main.py", line 10, in import josepy as jose File "/usr/lib/python3/dist-packages/josepy/init.py", line 44, in from josepy.interfaces import JSONDeSerializable File "/usr/lib/python3/dist-packages/josepy/interfaces.py", line 8, in from josepy import errors, util File "/usr/lib/python3/dist-packages/josepy/util.py", line 4, in import OpenSSL File "/usr/lib/python3/dist-packages/OpenSSL/init.py", line 8, in from OpenSSL import crypto, SSL File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 16, in from OpenSSL._util import ( File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 6, in from cryptography.hazmat.bindings.openssl.binding import Binding File "/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl/binding.py", line 13, in from cryptography.hazmat.bindings._openssl import ffi, lib ImportError: /usr/local/lib/libcrypto.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3/dist-packages/cryptography/hazmat/bindings/_openssl.abi3.so) ``` Works fine in regular Ubuntu 18.04 (not chroot) of the same server, but does not work inside the chroot because of the conflict between the chroot previously installed older openssl 1.1.0h (vulnerable/insecure), and the updated openssl 1.1.1 (safer). I can reproduce this problem on every Ubuntu 18.04 server we have setup. Steps all work fine in 16.04 servers (but 16.04 is near End of Life (EOL), so must get this working on 18.04).

By Ha Ro user 29 Jul 2020 at 10:31 p.m. CDT

Ha Ro gravatar
Apparently solution is to make the default python version inside the chroot version 3.5.2. instead of the default 2.7.16rc1. Details pending.