ssl: test_distrusted_spki fails on AWS-LC builds #160736

Bug report

The distrusted-SPKI denylist added in gh-160040 reports a different verification error depending on which libcrypto CPython is built against. If built against AWS-LC, test_distrusted_spki fails because AWS-LC contains a denylist for the SPKI's and returns a different error code.

cpython should not assume a specific error-code when path verification returns with an error.

Happy to throw up a PR with the preferred fix.

More details

_ssl_verify_callback() in Modules/_ssl.c returns early when the library has already failed the certificate:

/* Don't override an error OpenSSL already reported for this certificate. */
if (!preverify_ok) {
    return preverify_ok;
}

It assumes the underlying library has no opinion about the compromised keys. In AWS-LC, we implemented a denylist in aws/aws-lc@d764b79

This affects all versions were the denylist has been backported.

Possible fix

Raising it as an issue rather than opening a PR directly because can be several reasonable fixes.

I would suggest the following: Drop the early return, always look up the SPKI, and set X509_V_ERR_CERT_REJECTED whenever the key matches. Chains that are not on the denylist keep the library's original error exactly as today.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-160736: Fix test_distrusted_spki on AWS-LC builds #161213