module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

Question

I was using python 3.6 on my ubuntu machine and faced this error when doing some testing:

CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography and will be removed in a future release.
...
from OpenSSL import crypto, SSL
default:       File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1550, in <module>
default:         class X509StoreFlags(object):
default:       File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1570, in X509StoreFlags
default:         CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
default:     AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

Did research on the error. So I installed python 3.9 and then update alternatives to assign python 3.9 as the main python to use. Then I reinstall and upgrade OpenSSL and Cryptography.

sudo pip3 install pyOpenSSL --upgrade
sudo pip3 install cryptography --upgrade

I run my testing again and still face the same error.

I decided to check the python3.9 dist-packages folder (/usr/local/lib/python3.9/dist-packages/) and realise that OpenSSL and Cryptography are nowhere to be found. They are found in /usr/local/lib/python3.6/dist-packages/ instead. Could this be why the error persist?

Answer 1

I ran into this with pyOpenSSL==19.0.0 and was able to fix this with

pip3 install pyOpenSSL --upgrade

Answer 2

It seems to be due to pip 22.2.2 upgrade. Check if you can upgrade pyOpenSSL to 22.0.0 to fix the issue.

Let me know if it is not working.

Answer 3

I had the same problem. You need to update pip to latest version.

1. Delete old version

sudo apt remove python3-pip 

2. Based on the pip Install guide, do the following:

wget https://bootstrap.pypa.io/get-pip.py
sudo python3 get-pip.py

Answer 4

My pip stopped working due to the issue (I couldn't even get the version).

I resolved this issue by download the problem package from pypi.org and update it via easy_install module:

python3 -m easy_install pyOpenSSL-22.0.0-py2.py3-none-any.whl

Answer 5

After upgrading cryptography to version 38.0.1, the pip command was completely broken on my Linux system, I couldn't fix it in any way. I could solve the issue only by removing the line

"CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK"

from the file /usr/lib/python3/dist-packages/OpenSSL/crypto.py

Hooray! After this, pip worked again and I could downgrade cryptography to a version compatible with pyOpenSSL==20.0.1:

pip uninstall cryptography

pip install --upgrade cryptography==36.0.2

Answer 6

Had the same error. Updated the pyOpenSSL package with 22.0.0 version. Working fine now.

Answer 7

pyOpenSSL < 22.0.0 seems to be incompatible since they did not pin the cryptography package. Since the latest cryptography package was installed in version prior 22.0.0 they simply break.

Corresponding Github issue: https://github.com/pyca/pyopenssl/issues/1143

Answer 8

I fixed it by removing the openSSL python package directory

sudo rm -R /usr/lib/python3/dist-packages/OpenSSL

Then just install the OpenSSL library again

pip3 install pyOpenSSL --upgrade

Answer 9

Warning!!! if you are using pyOpenSSL==20.0.1 and find this error when building new container image. Upgrade to pyOpenSSL==22.0.0 could fix this problem, but may cause CPU load Higher. It cause for 50% qps loss for our system which is running a heavy load requests & upload system.

Finally, we rollback pyOpenSSL==22.0.0 to pyOpenSSL==20.0.1 and manually install cryptography==36.0.2 to fix the problem.

Answer 10

Note, when I say "which is the situation we are in right now", I am referring to the fact that every release of pyOpenSSL before version 22.0.0 is incompatible with cryptography versions from 38.0.0, but pip does not know this, so can't correctly resolve the dependency issue.

https://github.com/pyca/pyopenssl/issues/1143#issuecomment-1246086105

In my case, my Ubuntu 20.04 has pyOpenSSL version 19.0.0 installed while the cryptography version is 38.0.3.

Answer 11

I had same problem. When it happens i saw log like this.

Oct 26 00:59:45 d51307 certbot[4185368]:     from OpenSSL import crypto, SSL
Oct 26 00:59:45 d51307 certbot[4185368]:   File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1553, in <module>
Oct 26 00:59:45 d51307 certbot[4185368]:     class X509StoreFlags(object):
Oct 26 00:59:45 d51307 certbot[4185368]:   File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1573, in X509StoreFlags
Oct 26 00:59:45 d51307 certbot[4185368]:     CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
Oct 26 00:59:45 d51307 certbot[4185368]: AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
Oct 26 00:59:45 d51307 systemd[1]: certbot.service: Main process exited, code=exited, status=1/FAILURE

Then i try apt remove python3-pip and apt install python3-pip and it helps me. Then i run certbot and it works

Answer 12

First, comment out below line in /usr/lib/python3/dist-packages/OpenSSL/crypto.py

CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK

Then, run below commands to update pip3 and pyopenssl

pip3 install pip --upgrade
pip3 install pyopenssl --upgrade

Last, uncomment the line in first step. You should be able to use pip3 now

Answer 13

I managed to solve this issue by downgrading cryptography library using following command.

pip install cryptography==36.0.0

Answer 14

This appears to be a dependency conflict with conda as some installed package versions are inconsistent with the python in base env. To be sure that it is not what causes your problem you can run (in the base environment)

conda update --all

This will give you an update plan with resolved dependencies along with the newest versions installed and eventually resolve the conflict of using pip with cryptography package which was resolved with recent conda updates.

After updating conda type pip list and if this was the root of all the doomseeds you will get rid of this error.