Skip to content

DOCSP-43384: Troubleshooting openssl legacy unsafe renegotiation #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 30, 2024
Merged

DOCSP-43384: Troubleshooting openssl legacy unsafe renegotiation #115

Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
650f041
initial commit
mayaraman19 Oct 28, 2024
3cc6cce
mini changes
mayaraman19 Oct 28, 2024
060623c
link
mayaraman19 Oct 28, 2024
c39fef2
address feedback
mayaraman19 Oct 29, 2024
c4c00eb
adding the
mayaraman19 Oct 29, 2024
c87b422
procedure + comments
mayaraman19 Oct 30, 2024
e900823
procedure normal
mayaraman19 Oct 30, 2024
039f73a
python error
mayaraman19 Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 47 additions & 1 deletion source/includes/troubleshooting/tls.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,4 +122,50 @@

- Downgrade Python to v3.9 or earlier
- Upgrade {+mdb-server+} to v4.2 or later
- Install {+driver-short+} with the :ref:`OCSP <pymongo-disable-ocsp>` option, which relies on PyOpenSSL
- Install {+driver-short+} with the :ref:`OCSP <pymongo-disable-ocsp>` option, which relies on PyOpenSSL

Unsafe Legacy Renegotiation Disabled
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When using OpenSSL v3 or later, you might see an error similar to the following
message:

.. code-block:: python

MongoServerSelectionError: 886E0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:c:\ws\deps\openssl\openssl\ssl\statem\extensions.c:922:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the Node error, the Python error would look like this:

 [SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled


These types of errors occur because of outdated or buggy SSL proxies that mistakenly
enforce legacy `TLS renegotiation <https://www.ibm.com/docs/en/i/7.3?topic=settings-renegotiation>`__.

To resolve this issue, create a configuration file that includes the
``UnsafeLegacyServerConnect`` option. This option requires OpenSSL v3.0.4 or
greater. The following example shows how to set the ``UnsafeLegacyServerConnect``
option:

.. code-block:: shell
:emphasize-lines: 10

openssl_conf = openssl_init

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Options = UnsafeLegacyServerConnect

Then run Python while setting the ``OPENSSL_CONF`` environment variable to use
the OpenSSL configuration file you just created:

.. code-block:: shell

OPENSSL_CONF=/path/to/the/config/file/above.cnf python ...

.. important::

Because setting the ``UnsafeLegacyServerConnect`` option has
`security implications <https://docs.openssl.org/3.0/man3/SSL_CTX_set_options/#patched-openssl-client-and-unpatched-server>`__,
this workaround should only be used as a last

Check failure on line 170 in source/includes/troubleshooting/tls.rst

View workflow job for this annotation

GitHub Actions / TDBX Vale rules 

[vale] reported by reviewdog 🐶
[MongoDB.AvoidSubjunctive] Avoid the subjunctive 'should'.

Raw Output:
{"message": "[MongoDB.AvoidSubjunctive] Avoid the subjunctive 'should'.", "location": {"path": "source/includes/troubleshooting/tls.rst", "range": {"start": {"line": 170, "column": 20}}}, "severity": "ERROR"}
resort to address ``unsafe legacy renegotiation disabled`` errors.
Loading