CentOS - Oct 2020 - certbot stopped working on CentOS 7: pyOpenSSL module missing required functionality

Hello fellow CentOS users,

I had this cronjob working for many moons on CentOS 7.8.2003:

#minute hour    mday    month   wday            command
6       6       *       *       1               certbot renew --post-hook
"cat /etc/letsencrypt/live/raspasy.de/fullchain.pem /etc/letsencrypt/live/
raspasy.de/privkey.pem > /etc/letsencrypt/live/raspasy.de/haproxy.pem;
systemctl resstart haproxy"

(I run a post hook, because haproxy-1.5.18-9.el7.x86_64 from the CentOS
packages wants to have the cert and the key in one file).

Unfortunately, now certbot-1.7.0-1.el7.noarch has stopped working and the
error message is:

/usr/lib/python2.7/site-packages/josepy/util.py:9:
CryptographyDeprecationWarning: Python 2 is no longer supported by the
Python core team. Support for it is now deprecated in cryptography, and
will be removed in a future release.
  from cryptography.hazmat.primitives.asymmetric import rsa
Traceback (most recent call last):
  File "/usr/bin/certbot", line 9, in <module>
    load_entry_point('certbot==1.7.0', 'console_scripts',
'certbot')()
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 378,
in
load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2566,
in
load_entry_point
    return ep.load()
  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line 2260,
in
load
    entry = __import__(self.module_name, globals(),globals(),
['__name__'])
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 2, in
<module>
    from certbot._internal import main as internal_main
  File "/usr/lib/python2.7/site-packages/certbot/_internal/main.py",
line
20, in <module>
    from certbot._internal import account
  File
"/usr/lib/python2.7/site-packages/certbot/_internal/account.py",
line 18, in <module>
    from acme.client import ClientBase  # pylint: disable=unused-import
  File "/usr/lib/python2.7/site-packages/acme/client.py", line 39, in
<module>
    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  #
type: ignore
  File
"/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
line 118, in inject_into_urllib3
    _validate_dependencies_met()
  File
"/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
line 160, in _validate_dependencies_met
    "'pyOpenSSL' module missing required functionality. "
ImportError: 'pyOpenSSL' module missing required functionality. Try
upgrading to v0.14 or newer.

I have the following python packages installed:

#  rpm -qa | grep python2
python2-oauthlib-2.0.1-8.el7.noarch
python2-futures-3.1.1-5.el7.noarch
python2-cryptography-1.7.2-2.el7.x86_64
python2-pip-8.1.2-14.el7.noarch
python2-acme-1.7.0-1.el7.noarch
python2-psycopg2-2.8.6-1.rhel7.x86_64
python2-certbot-1.7.0-1.el7.noarch
python2-pyrfc3339-1.1-3.el7.noarch
python2-distro-1.2.0-3.el7.noarch
python2-configargparse-0.11.0-2.el7.noarch
python2-josepy-1.3.0-2.el7.noarch
python2-pyasn1-0.1.9-7.el7.noarch
python2-six-1.9.0-0.el7.noarch
python2-parsedatetime-2.4-6.el7.noarch
python2-future-0.18.2-2.el7.noarch
python2-requests-oauthlib-0.8.0-5.el7.noarch
python2-mock-1.0.1-10.el7.noarch

Does anybody please have an idea, what could I do?

I like to use the stock packages only (for easier maintenance), wonder if a
solution is still possible there...

Thank you for any suggestions
Alex

> On Oct 5, 2020, at 7:04 AM, Alexander Farber <alexander.farber at
gmail.com> wrote:
> 
> Hello fellow CentOS users,
> 
> I had this cronjob working for many moons on CentOS 7.8.2003:
> 
> #minute hour    mday    month   wday            command
> 6       6       *       *       1               certbot renew --post-hook
> "cat /etc/letsencrypt/live/raspasy.de/fullchain.pem
/etc/letsencrypt/live/
> raspasy.de/privkey.pem > /etc/letsencrypt/live/raspasy.de/haproxy.pem;
> systemctl resstart haproxy"
> 
Should that be ?restart?? In the above you have double ?s?.

Valeri
> (I run a post hook, because haproxy-1.5.18-9.el7.x86_64 from the CentOS
> packages wants to have the cert and the key in one file).
> 
> Unfortunately, now certbot-1.7.0-1.el7.noarch has stopped working and the
> error message is:
> 
> /usr/lib/python2.7/site-packages/josepy/util.py:9:
> CryptographyDeprecationWarning: Python 2 is no longer supported by the
> Python core team. Support for it is now deprecated in cryptography, and
> will be removed in a future release.
>  from cryptography.hazmat.primitives.asymmetric import rsa
> Traceback (most recent call last):
>  File "/usr/bin/certbot", line 9, in <module>
>    load_entry_point('certbot==1.7.0', 'console_scripts',
'certbot')()
>  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line
378, in
> load_entry_point
>    return get_distribution(dist).load_entry_point(group, name)
>  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line
2566, in
> load_entry_point
>    return ep.load()
>  File "/usr/lib/python2.7/site-packages/pkg_resources.py", line
2260, in
> load
>    entry = __import__(self.module_name, globals(),globals(),
['__name__'])
>  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 2,
in
> <module>
>    from certbot._internal import main as internal_main
>  File
"/usr/lib/python2.7/site-packages/certbot/_internal/main.py", line
> 20, in <module>
>    from certbot._internal import account
>  File
"/usr/lib/python2.7/site-packages/certbot/_internal/account.py",
> line 18, in <module>
>    from acme.client import ClientBase  # pylint: disable=unused-import
>  File "/usr/lib/python2.7/site-packages/acme/client.py", line 39,
in
> <module>
>    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  #
> type: ignore
>  File
"/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
> line 118, in inject_into_urllib3
>    _validate_dependencies_met()
>  File
"/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
> line 160, in _validate_dependencies_met
>    "'pyOpenSSL' module missing required functionality. "
> ImportError: 'pyOpenSSL' module missing required functionality. Try
> upgrading to v0.14 or newer.
> 
> I have the following python packages installed:
> 
> #  rpm -qa | grep python2
> python2-oauthlib-2.0.1-8.el7.noarch
> python2-futures-3.1.1-5.el7.noarch
> python2-cryptography-1.7.2-2.el7.x86_64
> python2-pip-8.1.2-14.el7.noarch
> python2-acme-1.7.0-1.el7.noarch
> python2-psycopg2-2.8.6-1.rhel7.x86_64
> python2-certbot-1.7.0-1.el7.noarch
> python2-pyrfc3339-1.1-3.el7.noarch
> python2-distro-1.2.0-3.el7.noarch
> python2-configargparse-0.11.0-2.el7.noarch
> python2-josepy-1.3.0-2.el7.noarch
> python2-pyasn1-0.1.9-7.el7.noarch
> python2-six-1.9.0-0.el7.noarch
> python2-parsedatetime-2.4-6.el7.noarch
> python2-future-0.18.2-2.el7.noarch
> python2-requests-oauthlib-0.8.0-5.el7.noarch
> python2-mock-1.0.1-10.el7.noarch
> 
> Does anybody please have an idea, what could I do?
> 
> I like to use the stock packages only (for easier maintenance), wonder if a
> solution is still possible there...
> 
> Thank you for any suggestions
> Alex
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos

Yes, I had a typo in the mail, but not in the cronjob

Still wondering how to get certbot-1.7.0-1.el7.noarch working on CentOS 7
again.