[FLINK-33902] Switch to OpenSSL legacy algorithms

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.18.0, 1.19.0
• Fix Version/s: 1.19.0, 1.18.1
• Component/s: Build System
• Labels: github-actions pull-request-available
• Assignee: Matthias Pohl
• Reporter: Matthias Pohl
• Created: 20/Dec/23 12:00
• Updated: 21/Dec/23 13:56
• Resolved: 21/Dec/23 13:56

Description

In FLINK-33550 we discovered that the GHA runners provided by GitHub have a newer version of OpenSSL installed which caused errors in the SSL tests:

Certificate was added to keystore
Certificate was added to keystore
Certificate reply was installed in keystore
Error outputting keys and certificates
40F767F1D97F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()
Nov 14 15:39:21 [FAIL] Test script contains errors. 

The workaround is to enable legacy algorithms using the -legacy parameter in 3.0.0+. We might need to check whether that works for older OpenSSL version (in Azure CI).

Issue Links

• links to: GitHub Pull Request #23961
• links to: GitHub Pull Request #23979