[vstinner]

ECH hasn't been included in FIPS mode in OpenSSL so far.

• Issue: test_ssl fails with forced FIPS mode -- ssl.SSLError: [SSL] internal error (_ssl.c:1176) #161932

[vstinner]

Without the change, OPENSSL_FORCE_FIPS_MODE=1 ./python -m test test_ssl -m ECHTests -v fails on Fedora 45 with OpenSSL 4.0.3 with (see the issue for details):

ERROR: test_grease (test.test_ssl.ECHTests.test_grease)
ERROR: test_outer_alpn_without_ech_config (test.test_ssl.ECHTests.test_outer_alpn_without_ech_config)

With the change, the test pass successfully.

cc @picnixz

See #161739 for the previous test_hashlib fix for FIPS mode.

[picnixz]

Yeah, I don't mind skipping tests that fail on some FIPS builds rather than trying to hunt the reason why the fail. If someone sees wrong things happening, they'll just report it.