Styjun

Up front let me say please don't suggest I switch to Python 3. That's not what this question is about. Also, note this question is not about how to find OpenSSL headers/libraries during the Python build; as far as I can tell (see below) I have that working.

I'm building my own copy of Python 2.7 (I've tried both 2.7.15 and 2.7.16 with identical results) on a recent GNU/Linux distribution. I want to link it against my own built copy of OpenSSL (I've tried 1.1.1a and 1.1.1b). Note I've used this OpenSSL library with other apps and it seems to be built correctly.

The compilation, link, and install goes fine: I've got all my configuration figured out, shared library paths set up, etc. After my compile and install, I can load the ssl module with no problems:

$ python
Python 2.7.15 (default, Mar 24 2019, 14:08:05)
[GCC 8.1.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> print(ssl.OPENSSL_VERSION)
OpenSSL 1.1.1b 26 Feb 2019

However, when I try to use this python to install some package via setup.py that need to download files, it will fail to download. I extracted a test:

from setuptools.package_index import PackageIndex
PackageIndex().process_url(url='https://pypi.org/simple/backports.functools_lru_cache/',
 retrieve=True)

Gives this error:

Download error on https://pypi.org/simple/backports.functools_lru_cache/: [X509] system lib (_ssl.c:3027) -- Some packages may not be found!

I'm not sure what to do next; the error message refers to X509 so maybe there's something wrong with certificate handling? I've used strace on the binary and I can see that it is finding my system certificate directory (/etc/ssl) and my CRT file (/etc/ssl/certs/ca-certificates.crt).

Also: if I compile against my system version of OpenSSL, it works. And if I compile against a locally-build instance of LibreSSL, it also works.

I don't know where to go from here, to try to understand what the problem is. Help?