{"id":"4f3363f1a535bf97","repo":"aio-libs/aiohttp","slug":"ssl-is-not-supported","errorCode":null,"errorMessage":"SSL is not supported.","messagePattern":"SSL is not supported\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"aiohttp/worker.py","lineNumber":223,"sourceCode":"        self.cfg.worker_int(self)\n\n        # wakeup closing process\n        self._notify_waiter_done()\n\n    def handle_abort(self, sig: int, frame: FrameType | None) -> None:\n        self.alive = False\n        self.exit_code = 1\n        self.cfg.worker_abort(self)\n        sys.exit(1)\n\n    @staticmethod\n    def _create_ssl_context(cfg: Any) -> \"SSLContext\":\n        \"\"\"Creates SSLContext instance for usage in asyncio.create_server.\n\n        See ssl.SSLSocket.__init__ for more details.\n        \"\"\"\n        if ssl is None:  # pragma: no cover\n            raise RuntimeError(\"SSL is not supported.\")\n\n        ctx = ssl.SSLContext(cfg.ssl_version)\n        ctx.load_cert_chain(cfg.certfile, cfg.keyfile)\n        ctx.verify_mode = cfg.cert_reqs\n        if cfg.ca_certs:\n            ctx.load_verify_locations(cfg.ca_certs)\n        if cfg.ciphers:\n            ctx.set_ciphers(cfg.ciphers)\n        return ctx\n\n    def _get_valid_log_format(self, source_format: str) -> str:\n        if source_format == self.DEFAULT_GUNICORN_LOG_FORMAT:\n            return self.DEFAULT_AIOHTTP_LOG_FORMAT\n        elif re.search(r\"%\\([^\\)]+\\)\", source_format):\n            raise ValueError(\n                \"Gunicorn's style options in form of `%(name)s` are not \"\n                \"supported for the log formatting. Please use aiohttp's \"\n                \"format specification to configure access log formatting: \"","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/worker.py#L205-L241","documentation":"Raised by GunicornWebWorker._create_ssl_context() when the Python `ssl` stdlib module failed to import. The import at the top of worker.py is wrapped in try/except ImportError and falls back to ssl=None; if you then enable SSL in the gunicorn config (certfile/keyfile/ssl_version), the worker cannot build an SSLContext and aborts.","triggerScenarios":"Running the gunicorn aiohttp worker with SSL enabled (`--certfile`/`--keyfile` or `cfg.is_ssl`) on a Python interpreter compiled without OpenSSL/ssl support, so `import ssl` raised ImportError and ssl is None.","commonSituations":"A custom or minimal Python build (e.g. some embedded/Alpine images without openssl-dev at compile time); a broken system OpenSSL that prevented the ssl module from building; a container image missing libssl.","solutions":["Use a Python build with SSL support: install openssl dev headers and rebuild/reinstall Python, or use an official CPython distribution.","On Alpine install `libssl`/`libcrypto` and `openssl`; on Debian `apt-get install libssl-dev` and rebuild Python.","If SSL is not actually required, disable it in the gunicorn config (remove certfile/keyfile) and terminate TLS at a reverse proxy instead.","Verify with `python -c \"import ssl; print(ssl.OPENSSL_VERSION)\"` before starting the worker."],"exampleFix":"# verify ssl support first\n# python -c 'import ssl; print(ssl.OPENSSL_VERSION)'\n# if it fails, rebuild python with openssl, e.g. on debian:\n#   apt-get install -y libssl-dev && reinstall/rebuild python\n\n# gunicorn config: only enable ssl when import ssl works\n","handlingStrategy":"validation","validationCode":"import ssl\n\ndef assert_ssl_available():\n    if ssl is None:\n        raise RuntimeError(\"SSL is not supported by this interpreter\")\n    return ssl","typeGuard":"import sys\n\ndef has_ssl() -> bool:\n    try:\n        import ssl\n        return True\n    except ImportError:\n        return False","tryCatchPattern":null,"preventionTips":["Run `python -c \"import ssl\"` before enabling SSL in the gunicorn config.","Use a Python build linked against OpenSSL (official builds, or install libssl-dev before building).","Terminate TLS at a reverse proxy if the interpreter cannot support ssl."],"tags":["gunicorn","worker","ssl","environment"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}