New subject: certbot stopped working on CentOS 7: pyOpenSSL module missing required functionality

5 Oct 2020


      Hello fellow CentOS users,
I had this cronjob working for many moons on CentOS 7.8.2003:
#minute hour    mday    month   wday            command
6       6       *       *       1               certbot renew --post-hook
"cat /etc/letsencrypt/live/raspasy.de/fullchain.pem /etc/letsencrypt/live/
raspasy.de/privkey.pem > /etc/letsencrypt/live/raspasy.de/haproxy.pem;
systemctl resstart haproxy"
(I run a post hook, because haproxy-1.5.18-9.el7.x86_64 from the CentOS
packages wants to have the cert and the key in one file).
Unfortunately, now certbot-1.7.0-1.el7.noarch has stopped working and the
error message is:
/usr/lib/python2.7/site-packages/josepy/util.py:9:
CryptographyDeprecationWarning: Python 2 is no longer supported by the
Python core team. Support for it is now deprecated in cryptography, and
will be removed in a future release.
  from cryptography.hazmat.primitives.asymmetric import rsa
Traceback (most recent call last):
  File "/usr/bin/certbot", line 9, in <module>
    load_entry_point('certbot==1.7.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 378, in
load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2566, in
load_entry_point
    return ep.load()
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2260, in
load
    entry = __import__(self.module_name, globals(),globals(), ['__name__'])
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 2, in
<module>
    from certbot._internal import main as internal_main
  File "/usr/lib/python2.7/site-packages/certbot/_internal/main.py", line
20, in <module>
    from certbot._internal import account
  File "/usr/lib/python2.7/site-packages/certbot/_internal/account.py",
line 18, in <module>
    from acme.client import ClientBase  # pylint: disable=unused-import
  File "/usr/lib/python2.7/site-packages/acme/client.py", line 39, in
<module>
    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  #
type: ignore
  File "/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
line 118, in inject_into_urllib3
    _validate_dependencies_met()
  File "/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
line 160, in _validate_dependencies_met
    "'pyOpenSSL' module missing required functionality. "
ImportError: 'pyOpenSSL' module missing required functionality. Try
upgrading to v0.14 or newer.
I have the following python packages installed:
#  rpm -qa | grep python2
python2-oauthlib-2.0.1-8.el7.noarch
python2-futures-3.1.1-5.el7.noarch
python2-cryptography-1.7.2-2.el7.x86_64
python2-pip-8.1.2-14.el7.noarch
python2-acme-1.7.0-1.el7.noarch
python2-psycopg2-2.8.6-1.rhel7.x86_64
python2-certbot-1.7.0-1.el7.noarch
python2-pyrfc3339-1.1-3.el7.noarch
python2-distro-1.2.0-3.el7.noarch
python2-configargparse-0.11.0-2.el7.noarch
python2-josepy-1.3.0-2.el7.noarch
python2-pyasn1-0.1.9-7.el7.noarch
python2-six-1.9.0-0.el7.noarch
python2-parsedatetime-2.4-6.el7.noarch
python2-future-0.18.2-2.el7.noarch
python2-requests-oauthlib-0.8.0-5.el7.noarch
python2-mock-1.0.1-10.el7.noarch
Does anybody please have an idea, what could I do?
I like to use the stock packages only (for easier maintenance), wonder if a
solution is still possible there...
Thank you for any suggestions
Alex