CentOS/8/Python 3.14

Python 3.14 with OpenSSL 3

1. Python 3.14 + OpenSSL 3.x on CentOS 8

This guide installs:

- OpenSSL 3.x in `/opt/openssl-3` - Python 3.14 in `/opt/python3.14` - Modern TLS support for Python `ssl`, `urllib`, `requests`, and `aiohttp` - Isolation from the OS Python and OpenSSL versions

This approach is recommended for environments that use:

- Corporate TLS inspection appliances - Internal Artifactory servers - Self-signed enterprise CAs - Modern TLS requirements

Python 3.14 requires OpenSSL 1.1.1 or newer for SSL support. [1](https://www.python.org/downloads/release/python-3140/)

---

1. 1. Install Build Dependencies

bash
dnf groupinstall -y "Development Tools"

dnf install -y \
    gcc \
    gcc-c++ \
    make \
    wget \
    perl \
    perl-IPC-Cmd \
    zlib-devel \
    bzip2-devel \
    libffi-devel \
    readline-devel \
    sqlite-devel \
    xz-devel \
    tk-devel \
    gdbm-devel \
    ncurses-devel

---

1. 2. Download and Build OpenSSL 3.x

bash
cd /usr/src

wget https://www.openssl.org/source/openssl-3.5.1.tar.gz

tar xf openssl-3.5.1.tar.gz

cd openssl-3.5.1

Configure:

bash
./Configure \
    --prefix=/opt/openssl-3 \
    --openssldir=/opt/openssl-3 \
    shared \
    linux-x86_64

Build:

bash
make -j$(nproc)

Install:

bash
make install

Verify:

bash
/opt/openssl-3/bin/openssl version

Expected:

text
OpenSSL 3.5.x

---

1. 3. Configure Runtime Linker

Create:

bash
cat >/etc/ld.so.conf.d/openssl3.conf <<EOF
/opt/openssl-3/lib64
EOF

Refresh:

bash
ldconfig

Verify:

bash
ldconfig -p | grep ssl

Expected output should include:

text
libssl.so.3
libcrypto.so.3

---

1. 4. Download Python 3.14

bash
cd /usr/src

wget https://www.python.org/ftp/python/3make -j$(nproc)

---

1. 7. Install Python

bash
make install

Verify:

bash
/opt/python3.14/bin/python3.14 --version

Expected:

text
Python 3.14.6

---

1. 8. Verify OpenSSL Integration

bash
/opt/python3.14/bin/python3.14 -c "
import ssl
print(ssl.OPENSSL_VERSION)
"

Expected:

text
OpenSSL 3.5.x

---

1. 9. Verify HTTPS Works

bash
/opt/python3.14/bin/python3.14 -c "
import ssl
import urllib.request

print(ssl.OPENSSL_VERSION)
print(urllib.request.urlopen('https://www.python.org').status)
"

Expected:

text
OpenSSL 3.5.x
200

---

1. 10. Install Common Packages

bash
/opt/python3.14/bin/pip3.14 install \
    requests \
    aiohttp \
    certifi \
    truststore

Verify:

bash
/opt/python3.14/bin/pip3.14 list

---

1. 11. Verify Requests

python
import ssl
import requests

print("OpenSSL:", ssl.OPENSSL_VERSION)

r = requests.get(
    "https://www.python.org",
    timeout=30
)

print(r.status_code)

Expected:

text
OpenSSL: OpenSSL 3.x.x
200

---

1. 12. Check Python Trust Stores

Show OpenSSL trust path:

python
import ssl

print(ssl.get_default_verify_paths())

Show Certifi path:

python
import certifi

print(certifi.where())

This helps troubleshoot situations where:

- `curl` works - Browser works - Python Requests fails

because Requests typically uses Certifi rather than the OS trust store.

---

1. 13. Force Requests to Use the OS Trust Store

For enterprise environments this is often recommended.

python
import truststore

truststore.inject_into_ssl()

Example:

```python