commit e3228a3f44e382b6cdd2b5e001b651347013a7d3
author Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Tue Aug 14 10:52:27 2018 -0400
committer Christian Heimes <christian@python.org> Tue Aug 14 16:52:27 2018 +0200
tree fb55d7ff5a4d550a4a2993e57af9e32f96141853
parent 6c140609770ba161a5bb8aa36ecef0d38e6642df

bpo-34399: 2048 bits RSA keys and DH params (GH-8762) (GH-8763)

Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 88bfd0bce05043f658e50addd21366f317995e35)

Co-authored-by: Christian Heimes <christian@python.org>

Lib/test/test_ssl.py

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index d80e8d3..5c22630 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -55,7 +55,6 @@
 BYTES_CAPATH = os.fsencode(CAPATH)
 CAFILE_NEURONIO = data_file("capath", "4e1295a3.0")
 CAFILE_CACERT = data_file("capath", "5ed36f99.0")
-WRONG_CERT = data_file("wrongcert.pem")
 
 CERTFILE_INFO = {
     'issuer': ((('countryName', 'XY'),),
@@ -118,7 +117,7 @@
 NOKIACERT = data_file("nokia.pem")
 NULLBYTECERT = data_file("nullbytecert.pem")
 
-DHFILE = data_file("dh1024.pem")
+DHFILE = data_file("ffdh3072.pem")
 BYTES_DHFILE = os.fsencode(DHFILE)
 
 # Not defined in all versions of OpenSSL
@@ -2846,8 +2845,8 @@
         connect to it with a wrong client certificate fails.
         """
         client_context, server_context, hostname = testing_context()
-        # load client cert
-        client_context.load_cert_chain(WRONG_CERT)
+        # load client cert that is not signed by trusted CA
+        client_context.load_cert_chain(CERTFILE)
         # require TLS client authentication
         server_context.verify_mode = ssl.CERT_REQUIRED
         # TLS 1.3 has different handshake
@@ -2879,7 +2878,8 @@
     @unittest.skipUnless(ssl.HAS_TLSv1_3, "Test needs TLS 1.3")
     def test_wrong_cert_tls13(self):
         client_context, server_context, hostname = testing_context()
-        client_context.load_cert_chain(WRONG_CERT)
+        # load client cert that is not signed by trusted CA
+        client_context.load_cert_chain(CERTFILE)
         server_context.verify_mode = ssl.CERT_REQUIRED
         server_context.minimum_version = ssl.TLSVersion.TLSv1_3
         client_context.minimum_version = ssl.TLSVersion.TLSv1_3