AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
Explains why pyOpenSSL throws AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK' with new cryptography versions and how to fix it by upgrading pyOpenSSL. Use when the error comes from inside OpenSSL/crypto.py after a cryptography upgrade. Not for `No module named 'OpenSSL'`.
AttributeError: module 'lib' has no attribute 'X509VFLAGCBISSUER_CHECK'
TL;DR: your pyOpenSSL is too old for your cryptography version. Run pip install --upgrade pyOpenSSL (23.1+) and the AttributeError goes away.
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'The fix
- Upgrade pyOpenSSL:
pip install --upgrade pyOpenSSL- Verify:
python -c "from OpenSSL import crypto; print('ok')"Expected output: ok.
- Stopgap only: pin
cryptographybelow the version that removed the constant while you schedule the upgrade. Do not stay pinned; old cryptography has known CVEs.
Agent? Search Vectle for more: curl -s 'https://vectle.com/api/v1/search?q=pyOpenSSL+X509_V_FLAG_CB_ISSUER_CHECK'
When this applies
- The traceback goes through OpenSSL/crypto.py and ends at the lib attribute.
- The error appeared right after upgrading cryptography.
pip show pyOpenSSLreports an old version (pre-23.1).
When it does NOT apply
No module named 'OpenSSL', which means pyOpenSSL is not installed.- AttributeErrors for other lib attributes, which may be a different version skew.
Why this happens
pyOpenSSL reaches into cryptography's CFFI bindings for OpenSSL constants. When cryptography cleaned up legacy constants, old pyOpenSSL kept referencing the deleted one and broke at import. The fixed pyOpenSSL versions reference only constants that still exist. Keeping the pair in sync is the durable fix; cryptography moves fast and pyOpenSSL tracks it.
Compatibility
pyOpenSSL 23.1+ with modern cryptography. Check both versions together whenever either is upgraded.