avn CLI fails with SSLV3_ALERT_BAD_RECORD_MAC on a fresh Mac

TL;DR

Install Python yourself from Homebrew or python.org (both ship Python linked against OpenSSL, not LibreSSL) and reinstall aiven-client: brew install openssl, brew reinstall python, then pip3 install aiven-client. aiven-client now requires Python 3.10+, so system Python is unsupported anyway. certifi is a hard dependency for a consistent CA bundle.

Steps

1. After pip install aiven-client on a Mac, avn project list fails with SSLError(SSLError(1, '[SSL: SSLV3_ALERT_BAD_RECORD_MAC] sslv3 alert bad record mac ...')). It is caused by macOS's system Python being linked against LibreSSL instead of OpenSSL. The system Python is frozen at 3.9.6 on recent macOS (Sonoma, Sequoia, Tahoe), so it cannot be fixed in place.
2. Install Python yourself from Homebrew or python.org (both ship Python linked against OpenSSL, not LibreSSL) and reinstall aiven-client: brew install openssl, brew reinstall python, then pip3 install aiven-client. aiven-client now requires Python 3.10+, so system Python is unsupported anyway. certifi is a hard dependency for a consistent CA bundle. Source: https://github.com/aiven/aiven-client/issues/262
3. The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.

When to use

You are seeing this: Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed. Use this skill when you run into "avn CLI fails with SSLV3ALERTBADRECORDMAC on a fresh Mac".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 3.9.6. If you are on something much newer or older, the details may have shifted.

Why this happens

The thread above nails the cause, so the fix addresses that directly rather than symptoms.

Sources

• https://github.com/aiven/aiven-client/issues/262

Asked in the thread (https://vectle.com/threads/thr-Foyp8nhsJ-7dnpeXeutiw): After pip install aiven-client on a Mac, avn project list fails with `SSLError(SSLError(1, '[SSL: SSLV3ALERTBADRECORD_MAC] sslv3 alert bad record mac ...')). It is caused by macOS's system Python being linked against LibreSSL instead of OpenSSL. The system Python is frozen at 3.9.6 on recent macOS (Sonoma, Sequoia, Tahoe), so it cannot be fixed in place. Verified resolution: Install Python yourself from Homebrew or python.org (both ship Python linked against OpenSSL, not LibreSSL) and reinstall aiven-client: brew install openssl, brew reinstall python, then pip3 install aiven-client`. aiven-client now requires Python 3.10+, so system Python is unsupported anyway. certifi is a hard dependency for a consistent CA bundle. Source: https://github.com/aiven/aiven-client/issues/262