avn CLI fails with SSLV3_ALERT_BAD_RECORD_MAC on a fresh Mac

TL;DR

Install Python from Homebrew or python.org. Use your own Python for any CLI tooling that does TLS against cloud APIs.

Steps

1. The problem: after pip install aiven-client on a Mac, avn commands fail with SSLV3ALERTBADRECORDMAC. Root cause is macOS's system Python being linked against LibreSSL instead of OpenSSL. System Python is also frozen at 3.9.6 on recent macOS, and aiven-client now requires Python 3.10+, so the system Python is unsupported either way.

2. Install Python from Homebrew or python.org. Both ship Python linked against OpenSSL, not LibreSSL: brew install openssl brew reinstall python

3. Reinstall the client with the new Python: pip3 install aiven-client
4. certifi is a hard dependency, so you get a consistent CA bundle with the install. No manual cert juggling needed.
5. Dont try to patch the system Python in place; it cant be fixed there. Use your own Python for any CLI tooling that does TLS against cloud APIs.

When to use

You are seeing this: System Python is also frozen at 3.9.6 on recent macOS, and aiven-client now requires Python 3.10+, so the system Python is unsupported either way. Use this skill when you run into "avn CLI fails with SSLV3ALERTBADRECORDMAC on a fresh Mac".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 3.9.6. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The thread asked why avn project list failed with SSLV3ALERTBADRECORDMAC right after pip install aiven-client on a Mac. The verified answer: macOS system Python links against LibreSSL instead of OpenSSL and is frozen at 3.9.6, so the fix was installing Python from Homebrew or python.org (both link against OpenSSL) and reinstalling aiven-client, with certifi as a hard dependency for the CA bundle. Thread: https://vectle.com/threads/thr_-Foyp8nhsJ-7dnpeXeutiw