I'm trying to make an IRCd from Python, I am running into a problem with TLS 1.1 on my VPS running Debian 12.
Trying to connect to the server with TLSv1.1
$ openssl s_client -tls1_1 irc.ircat.xyz:6697
Connecting to 66.94.120.223
CONNECTED(00000003)
285B6905297F0000:error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available:ssl/statem/statem_lib.c:153:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 7 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
This TLS version forbids renegotiation.
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
But anything else would work fine:
$ openssl s_client -tls1_3 irc.ircat.xyz:6697
Connecting to 66.94.120.223
CONNECTED(00000003)
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=E6
verify return:1
depth=0 CN=irc.ircat.xyz
verify return:1
---
Certificate chain
0 s:CN=irc.ircat.xyz
i:C=US, O=Let's Encrypt, CN=E6
a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
v:NotBefore: Jan 3 03:20:06 2025 GMT; NotAfter: Apr 3 03:20:05 2025 GMT
1 s:C=US, O=Let's Encrypt, CN=E6
i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
---
-snip-
subject=CN=irc.ircat.xyz
issuer=C=US, O=Let's Encrypt, CN=E6
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2388 bytes and written 331 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
This TLS version forbids renegotiation.
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
-snip-
read R BLOCK
:peppermint.ircat.xyz NOTICE * :*** Looking for your hostname...
My cipher list on default context:
Python 3.11.2 (main, Nov 30 2024, 21:22:50) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> cntx = ssl.create_default_context()
>>> cntx.get_ciphers()
[{'id': 50336514, 'name': 'TLS_AES_256_GCM_SHA384', 'protocol': 'TLSv1.3', 'description': 'TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50336515, 'name': 'TLS_CHACHA20_POLY1305_SHA256', 'protocol': 'TLSv1.3', 'description': 'TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50336513, 'name': 'TLS_AES_128_GCM_SHA256', 'protocol': 'TLSv1.3', 'description': 'TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50380844, 'name': 'ECDHE-ECDSA-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380848, 'name': 'ECDHE-RSA-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331807, 'name': 'DHE-RSA-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50384041, 'name': 'ECDHE-ECDSA-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50384040, 'name': 'ECDHE-RSA-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50384042, 'name': 'DHE-RSA-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50380843, 'name': 'ECDHE-ECDSA-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380847, 'name': 'ECDHE-RSA-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331806, 'name': 'DHE-RSA-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50380836, 'name': 'ECDHE-ECDSA-AES256-SHA384', 'protocol': 'TLSv1.2', 'description': 'ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380840, 'name': 'ECDHE-RSA-AES256-SHA384', 'protocol': 'TLSv1.2', 'description': 'ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331755, 'name': 'DHE-RSA-AES256-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha256', 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50380835, 'name': 'ECDHE-ECDSA-AES128-SHA256', 'protocol': 'TLSv1.2', 'description': 'ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380839, 'name': 'ECDHE-RSA-AES128-SHA256', 'protocol': 'TLSv1.2', 'description': 'ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331751, 'name': 'DHE-RSA-AES128-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50380810, 'name': 'ECDHE-ECDSA-AES256-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380820, 'name': 'ECDHE-RSA-AES256-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331705, 'name': 'DHE-RSA-AES256-SHA', 'protocol': 'SSLv3', 'description': 'DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50380809, 'name': 'ECDHE-ECDSA-AES128-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe', 'auth': 'auth-ecdsa'}, {'id': 50380819, 'name': 'ECDHE-RSA-AES128-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe', 'auth': 'auth-rsa'}, {'id': 50331699, 'name': 'DHE-RSA-AES128-SHA', 'protocol': 'SSLv3', 'description': 'DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-dhe', 'auth': 'auth-rsa'}, {'id': 50331821, 'name': 'RSA-PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=RSAPSK Au=RSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331819, 'name': 'DHE-PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50384046, 'name': 'RSA-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=RSAPSK Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50384045, 'name': 'DHE-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=DHEPSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50384044, 'name': 'ECDHE-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'ECDHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=ECDHEPSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50331805, 'name': 'AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50331817, 'name': 'PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'PSK-AES256-GCM-SHA384 TLSv1.2 Kx=PSK Au=PSK Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50384043, 'name': 'PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'PSK-CHACHA20-POLY1305 TLSv1.2 Kx=PSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331820, 'name': 'RSA-PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=RSAPSK Au=RSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331818, 'name': 'DHE-PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331804, 'name': 'AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50331816, 'name': 'PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'PSK-AES128-GCM-SHA256 TLSv1.2 Kx=PSK Au=PSK Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331709, 'name': 'AES256-SHA256', 'protocol': 'TLSv1.2', 'description': 'AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha256', 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50331708, 'name': 'AES128-SHA256', 'protocol': 'TLSv1.2', 'description': 'AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50380856, 'name': 'ECDHE-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380854, 'name': 'ECDHE-PSK-AES256-CBC-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES256-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380833, 'name': 'SRP-RSA-AES-256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'SRP-RSA-AES-256-CBC-SHA SSLv3 Kx=SRP Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-srp', 'auth': 'auth-rsa'}, {'id': 50380832, 'name': 'SRP-AES-256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'SRP-AES-256-CBC-SHA SSLv3 Kx=SRP Au=SRP Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-srp', 'auth': 'auth-srp'}, {'id': 50331831, 'name': 'RSA-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-AES256-CBC-SHA384 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331827, 'name': 'DHE-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331797, 'name': 'RSA-PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'RSA-PSK-AES256-CBC-SHA SSLv3 Kx=RSAPSK Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331793, 'name': 'DHE-PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'DHE-PSK-AES256-CBC-SHA SSLv3 Kx=DHEPSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331701, 'name': 'AES256-SHA', 'protocol': 'SSLv3', 'description': 'AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50331823, 'name': 'PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'PSK-AES256-CBC-SHA384 TLSv1 Kx=PSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331789, 'name': 'PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380855, 'name': 'ECDHE-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380853, 'name': 'ECDHE-PSK-AES128-CBC-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES128-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380830, 'name': 'SRP-RSA-AES-128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'SRP-RSA-AES-128-CBC-SHA SSLv3 Kx=SRP Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-srp', 'auth': 'auth-rsa'}, {'id': 50380829, 'name': 'SRP-AES-128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'SRP-AES-128-CBC-SHA SSLv3 Kx=SRP Au=SRP Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-srp', 'auth': 'auth-srp'}, {'id': 50331830, 'name': 'RSA-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331826, 'name': 'DHE-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331796, 'name': 'RSA-PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'RSA-PSK-AES128-CBC-SHA SSLv3 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331792, 'name': 'DHE-PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'DHE-PSK-AES128-CBC-SHA SSLv3 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331695, 'name': 'AES128-SHA', 'protocol': 'SSLv3', 'description': 'AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-rsa', 'auth': 'auth-rsa'}, {'id': 50331822, 'name': 'PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'PSK-AES128-CBC-SHA256 TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331788, 'name': 'PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'PSK-AES128-CBC-SHA SSLv3 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-psk', 'auth': 'auth-psk'}]
Is missing ones with 'protocol' set to 'TLSv1.1' or 'SSLv2', is this a problem with the default context, or is it how OpenSSL (or Python) was pre-compiled on Debian?
SSLv2 is insecure for decades. It is not even available in modern TLS stacks anymore. Even the successor SSLv3 usually is often removed from the code or at least not compiled in by default. And while TLS 1.0 and TLS 1.1 are often still available in TLS stacks they are mostly disabled by default today since they are also considered no longer secure enough and would need to be specifically enabled when needed.
If the environment you use really requires anything lower than TLS 1.2 you should seriously think about upgrading the environment or - if not possible - to isolate it from other networks. Even if attacks at TLS 1.0 and TLS 1.1 are not practical for most users the reliance to it suggests an old and likely significantly vulnerable software stack in general.
Thus, better treat a non-working TLS 1.1 as a problem which need to be solved but instead consider it a security feature.
If you really need to support TLS 1.0 and higher you could use the following code to setup the SSL context in the server.
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.minimum_version = ssl.TLSVersion.TLSv1 # Allow TLS 1.0 and higher
context.set_ciphers('DEFAULT:@SECLEVEL=0') # allow weaker agorithms needed for TLS 1.0
Note that you also need to use similar options when testing with s_client, i.e.
openssl s_client -tlsv1 -cipher 'DEFAULT:@SECLEVEL=0' -connect ...
As for enabling anything below TLS 1.0 (i.e. SSLv3 or even SSLv2): You wuld likely need to compile your own openssl and maybe even use an older openssl version to have support for this. But there should really be no practical need even for older clients.