[3.15] gh-159387: Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0 (GH-159388) (#161320)

gh-159387: Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0 (GH-159388)

Fix TLS 1.0–1.2 availability detection with OpenSSL 4.0

OpenSSL 4.0 removed the version-specific methods but still supports
TLS 1.0–1.2 through TLS_method(). Stop reporting these versions as
unavailable, and expose legacy PROTOCOL_TLSv1* constants only when their corresponding methods exist.
(cherry picked from commit e7acd6a)

Co-authored-by: Pengyu Lee <lipengyu@kylinos.cn>

Author: miss-islington

Lib/test/test_ssl.py

@@ -4072,6 +4072,8 @@ def test_protocol_tlsv1_1(self):
         try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
 
     @requires_tls_version('TLSv1_2')
+    @unittest.skipUnless(hasattr(ssl, 'PROTOCOL_TLSv1_2'),
+                         'needs ssl.PROTOCOL_TLSv1_2')
     def test_protocol_tlsv1_2(self):
         """Connecting to a TLSv1.2 server with various client options.
            Testing against older TLS versions."""

Misc/NEWS.d/next/Library/2026-10-14-10-26-10.gh-issue-159387.xMbQbB.rst

@@ -0,0 +1,2 @@
+Fix :mod:`ssl` reporting TLS 1.0, 1.1, and 1.2 as unavailable when built
+with OpenSSL 4.0, despite support for these protocol versions.

Modules/_ssl.c

@@ -170,10 +170,9 @@ static void _PySSLFixErrno(void) {
 #endif
 
 #if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+/* OpenSSL 4.0 removed SSLv3 and the version-specific methods,
+ * but TLS 1.0, 1.1 and 1.2 are still available via TLS_method(). */
 #  define OPENSSL_NO_SSL3
-#  define OPENSSL_NO_TLS1
-#  define OPENSSL_NO_TLS1_1
-#  define OPENSSL_NO_TLS1_2
 #  define OPENSSL_NO_SSL3_METHOD
 #  define OPENSSL_NO_TLS1_METHOD
 #  define OPENSSL_NO_TLS1_1_METHOD
@@ -7123,13 +7122,13 @@ sslmodule_init_constants(PyObject *m)
     ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
     ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
     ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
-#ifndef OPENSSL_NO_TLS1
+#if !defined(OPENSSL_NO_TLS1) && !defined(OPENSSL_NO_TLS1_METHOD)
     ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
 #endif
-#ifndef OPENSSL_NO_TLS1_1
+#if !defined(OPENSSL_NO_TLS1_1) && !defined(OPENSSL_NO_TLS1_1_METHOD)
     ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
 #endif
-#ifndef OPENSSL_NO_TLS1_2
+#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_TLS1_2_METHOD)
     ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
 #endif