crypto/tls: unable to update some crypto/tls recorded tests

[derekparker]

What version of Go are you using (go version)?

$ rhel8-7d32e1526b2a-0# ../../../bin/go version                                          
$ go version devel +d2765de863 Thu May 2 15:38:36 2019 +0000 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ rhel8-7d32e1526b2a-0# ../../../bin/go env    
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/root/go"
GOPROXY="direct"
GOROOT="/go"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/go/src/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build126288050=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I attempted to update some of the recorded TLS tests using OpenSSL 1.1.1 built and configured according to the recommended way: ./config enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method.

What did you expect to see?

The test pass and a new recording generated.

What did you see instead?

OpenSSL failed to start due to a small key size:

=== RUN   TestRenegotiateTwiceRejected
=== RUN   TestRenegotiateTwiceRejected/TLSv12
--- FAIL: TestRenegotiateTwiceRejected (0.16s)
    --- FAIL: TestRenegotiateTwiceRejected/TLSv12 (0.16s)
        handshake_client_test.go:315: Failed to start subcommand: error connecting to the OpenSSL server: dial tcp 127.0.0.1:24323: connect: connection refused (exit status 1)
            
            Using default temp DH parameters
            error setting certificate
            140698504263488:error:0909006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:745:Expecting: DH PARAMETERS
            140698504263488:error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small:ssl/ssl_rsa.c:310:

[derekparker]

@FiloSottile @agl

[ianlancetaylor]

@FiloSottile I guess this didn't make 1.15, do you want a 1.16 milestone, or backlog? Thanks.

[ianlancetaylor]

Moving milestone to backlog.

[thomwiggers]

I ran into similar problems with my custom-compiled version of openssl 1.1.1g, where I enabled enable-weak-ssl-ciphers. The problem turned out to be that the ./apps/openssl version was still loading my system's openssl libraries, instead of the ones I had just compiled. This was fixed by adding no-shared to the ./config command line.

[gopherbot]

Change https://golang.org/cl/257517 mentions this issue: crypto/tls: add no-shared to openssl build instructions